kucoincom-login[.]webflow[.]io

This report analyzes the domain kucoincom-login.webflow.io, identified on July 12, 2026, as an active brand impersonation threat targeting KuCoin. The domain was registered through Webflow on April 11, 2026, and resolves to IP address 172.64.151.8, hosted by Cloudflare, Inc. in Canada. Analysis of VirusTotal shows 22 out of 94 security vendors flagging this domain as malicious. The SSL certificate is issued by Google Trust Services (WE1), and the HTTP status returns 200, indicating the page is live. The page title is 'Kucoin.com login: 𝑺î𝗴𝒏 i𝒏 - 𝐋 𝒈 𝐈𝙣', which uses Unicode characters to mimic legitimate login text. The domain appears on one security blocklist and has a Gridinsoft trust score of 0/100. It is currently blocked by PhishDestroy. The exact content of the page has not been visually analyzed, but the brand target and title strongly suggest it is designed to collect login credentials from KuCoin users. Defenders should block access to this domain at the DNS level, alert users to avoid any interaction with the URL or its IP address, and monitor for related subdomains or similar registration patterns through Webflow. The domain remains active as of this report date, posing a high risk to users.