kukuoiinlogen[.]webflow[.]io

The domain kukuoiinlogen.webflow.io is flagged as a brand‑impersonation site targeting Kucoin. Registration data shows the domain was created on May 08, 2013 and is registered through MarkMonitor, Inc., a registrar commonly used by legitimate enterprises. DNS resolution points to the IP address 172.64.151.8, which belongs to Cloudflare’s network (AS13335) and is located in the United States. The domain is served via Cloudflare’s edge, utilizes Webflow as the site builder, and negotiates HTTP/3 connections.

An SSL certificate issued by Google Trust Services (certificate identifier WE1) is present, indicating a valid HTTPS endpoint despite the malicious intent. The page title returned by the server is “Kucoin Login: Accessing Your Kucoin Account,” directly referencing the target brand. HTTP probing yields a 404 status, and the site has been taken offline, as confirmed by the PhishDestroy blocklist entry and the current offline status label. Security telemetry shows the domain appears on one external blocklist and has been flagged by 16 of 95 VirusTotal scanners, reflecting moderate detection consensus.

Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious classification. The infrastructure is consistent with a crypto‑scam campaign that leverages brand impersonation to harvest credentials or lure victims. Defenders should add the domain and its resolving IP to blocklists, monitor for any re‑registration attempts, and enforce outbound filtering for requests to Webflow‑hosted URLs that reference Kucoin. Continuous observation of Cloudflare‑originated domains with low trust scores is advised to pre‑empt re‑deployment of similar phishing infrastructure.