kucoenlogini[.]webflow[.]io

The domain kucoenlogini.webflow.io is currently active and has been classified as a credential phishing site with an elevated risk rating. Intelligence indicates that the domain is registered through Webflow, a platform commonly used for hosting static sites, and resolves to the IP address 172.64.151.8. It appears on one security blocklist and is specifically blocked by the PhishDestroy service, suggesting that at least one reputable anti-phishing feed has identified malicious activity associated with the domain.

VirusTotal analysis shows that 16 of 91 security vendors have flagged the domain, providing a moderate level of consensus among detection engines that the site is suspicious. No additional context such as page title, targeted brand, or specific phishing kit details is available, leaving the exact content and lure tactics unverified. Defenders should prioritize blocking network traffic to the resolved IP address 172.64.151.8 and add the full domain name to DNS filtering policies.

Monitoring for any new detections from additional security vendors is advised, as the current flag count may increase if the site propagates further. Organizations should also consider reviewing authentication logs for signs of credential harvesting attempts that could be linked to this domain, especially for users who may have interacted with Webflow‑hosted URLs. Given the elevated risk level and the presence on a blocklist, proactive containment and user awareness measures are recommended to mitigate potential credential compromise.