auth--apps-kucooin-sso---cdnn[.]webflow[.]io

This domain, auth--apps-kucooin-sso---cdnn.webflow.io, is an active credential phishing site impersonating the cryptocurrency exchange KuCoin. The domain was created on May 8, 2013, but its current use is malicious. It resolves to IP address 172.64.151.8, hosted in the United States on AS13335 (Cloudflare). The page title is 'KuCoin: Sign-in | Access Your Crypto Portfolio*', which is consistent with a fake login page designed to steal user credentials. SSL encryption is provided by Google Trust Services (WE1). VirusTotal detection shows 18 out of 91 security vendors flagging this domain as malicious. The site has a Gridinsoft trust score of 0 out of 100 and appears on one security blocklist (PhishDestroy). The domain is registered through MarkMonitor, Inc. and uses nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com. Technologies detected include Webflow, Cloudflare, and HTTP/3. The site returns HTTP status 200, confirming it is live. Defenders should block this domain at the network level, alert users to the phishing threat, and report it to KuCoin and relevant security platforms. The exact page content has not been visually confirmed, but the title and brand target strongly indicate a credential harvesting attack.