kucoinloginbe[.]webflow[.]io

Analysis of kucoinloginbe.webflow.io indicates that the domain is currently active and serves as a credential phishing vector. The domain resolves to the IP address 172.64.151.8, which is hosted by Webflow, Inc., the registrar listed in the registration metadata. VirusTotal has recorded 18 detections out of 95 security vendors, demonstrating a notable level of malicious classification across multiple scanning engines. The domain is present on a single external blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing its designation as a high‑risk phishing resource. Nameserver information could not be retrieved (NS_NOT_FOUND), limiting further DNS‑level attribution. No additional public evidence such as page titles, SSL certificates, or HTTP response codes is available at the time of this assessment, leaving the exact content and user‑experience details unverified. Given the confirmed detection footprint and the active hosting status, defenders should treat kucoinloginbe.webflow.io as a malicious credential‑phishing site. Recommended mitigations include adding the domain and its resolved IP address (172.64.151.8) to network denial‑list rules, updating endpoint protection signatures to reflect the 18 VirusTotal detections, and monitoring for any related traffic spikes or similar Webflow‑hosted subdomains. Continuous re‑evaluation is advised, as changes to the hosting environment or additional threat intelligence could alter the risk posture.