kucoiinklogn[.]webflow[.]io

This domain is flagged as an active credential harvesting site targeting KuCoin users. Analysis indicates a brand impersonation threat with elevated risk, designed to deceive victims into submitting account credentials through a fraudulent interface that replicates the legitimate exchange's login portal. Infrastructure analysis reveals the following technical indicators: the domain kucoiinklogn.webflow.io is registered through NameCheap, Inc. and resolves to IP address 172.64.151.8 (AS13335, Cloudflare, Inc., US). The SSL certificate is issued by Google Trust Services (WE1). Security vendors on VirusTotal detect the domain at 17/95, while it appears on one security blocklist and is actively blocked by PhishDestroy. The page title matches the domain name (kucoiinklogn), and the domain creation date is recorded as February 24, 2026, suggesting potential timestamp manipulation or future-dated registration. Mitigation steps for this specific threat type include immediate blocking of the domain and IP address across network security controls. Organizations should deploy email filtering rules to quarantine messages containing links to kucoiinklogn.webflow.io or related subdomains. End users should be alerted to verify domain authenticity before entering credentials, particularly for cryptocurrency platforms, and enable multi-factor authentication on all exchange accounts. Security teams should monitor for credential reuse attempts across other platforms following potential exposure through this phishing site.