kucoqinlogin[.]webflow[.]io

Analysis of kucoqinlogin.webflow.io indicates a brand‑impersonation infrastructure targeting KuCoin users. The domain resolves to 104.18.36.248, an address owned by Cloudflare (AS13335) located in the United States. DNS is served by journey.ns.cloudflare.com and lamar.ns.cloudflare.com, confirming Cloudflare as the authoritative provider. The SSL certificate is issued by Google Trust Services under the WE1 root, matching legitimate Cloudflare deployment and providing valid TLS but offering no indication of malicious content. HTTP requests return a 404 status, and the page title captured in the scan reads “KuCoin Guest Mode: Quick Access to Market Data Without Login @ % Kucoin Login”, which directly references the KuCoin brand and suggests an attempt to lure victims into a counterfeit guest‑access page.

The domain was registered on May 08 2013 through MarkMonitor, Inc., a registrar commonly used by legitimate enterprises, which may aid evasion of registrar‑level blocks. The site is flagged on a single blocklist, PhishDestroy, and VirusTotal records show 14 of 95 security vendors labeling the domain as malicious, consistent with the assigned scam type “Crypto Scam”. Gridinsoft assigns a trust score of 1 / 100, indicating extreme suspicion. Detected technologies include Cloudflare and HTTP/3, both typical of legitimate services and therefore not useful for discrimination. Current observations indicate that the domain is offline; the 404 response suggests the malicious page has been removed or taken down.

However, the presence of the brand‑impersonating title and the detection across multiple vendors imply that copies of the site or similar infrastructure could remain active elsewhere. Open questions include whether the 404 response is temporary, whether any active phishing payload was ever delivered, and whether the domain is part of a larger campaign using Cloudflare‑hosted subdomains. Defenders should continue to block kucoqinlogin.webflow.