loginkkucio[.]webflow[.]io

PhishDestroy identifies loginkkucio.webflow.io as an active credential phishing domain designed to harvest user login credentials. The domain is currently leveraged in social engineering campaigns aimed at deceiving victims into submitting sensitive information through a counterfeit login interface. Threat actors impersonate a legitimate service, tricking users into entering credentials that are subsequently exfiltrated for unauthorized access or further exploitation.

This domain was flagged by 12 of 95 VirusTotal security vendors, indicating significant detection coverage across multiple threat intelligence platforms. The domain resolves to IP address 104.18.36.248 and utilizes a Google Trust Services SSL certificate, suggesting an attempt to establish credibility. Historical DNS records show the domain was created recently, and its infrastructure aligns with patterns commonly associated with phishing operations. The presence of a compromised or fraudulent Webflow subdomain underscores the threat actor's use of reputable hosting services to evade detection.

Given the elevated risk posed by this domain, immediate action is recommended. Users are advised to avoid accessing or interacting with loginkkucio.webflow.io. Organizations should block this domain and its resolving IP at the network perimeter to prevent potential credential theft. Additionally, users who may have entered credentials on this domain should change passwords immediately and monitor accounts for suspicious activity. PhishDestroy users can report this domain to enhance collective threat intelligence and prevent further exploitation.