koqkilogons[.]webflow[.]io

This domain, koqkilogons.webflow.io, is identified as a brand impersonation threat specifically targeting KuCoin, a cryptocurrency exchange platform. The site presents itself as a legitimate KuCoin login portal, designed to harvest user credentials and facilitate unauthorized access to accounts. Analysis indicates the domain is currently offline, though prior activity suggests it was actively used for credential theft operations. Infrastructure analysis reveals the domain was registered through NameCheap, Inc. on February 21, 2026, and resolves to the IP address 172.64.151.8, hosted under AS13335 Cloudflare, Inc. in the United States. Security vendors have flagged this domain as malicious, with 18 out of 95 VirusTotal engines detecting it as a threat. The domain appears on at least one security blocklist and is associated with a Google Trust Services SSL certificate (WE1). The page title, 'KuCoin Login: Unlock your Reliable Trading Partner,' directly mimics official KuCoin branding to deceive users. Given the elevated risk level, this domain poses a significant threat to individuals attempting to access KuCoin services. While currently offline, the infrastructure remains a potential vector for future malicious activity. Users are strongly advised to verify the authenticity of any login portal before entering credentials. Organizations should monitor for similar impersonation domains, particularly those leveraging Content Delivery Network (CDN) services to obscure hosting origins. Immediate steps include blocking the domain and IP at the network level, updating endpoint protection rules, and educating users on recognizing brand impersonation tactics in cryptocurrency-related communications.