kulcoinlogin[.]webflow[.]io

The domain kulcoinlogin.webflow.io is currently active and hosts a credential‑harvesting landing page that mimics the official KuCoin login portal. The page title displayed to visitors reads “KuCoin Login: How to Access Your Account Easily,” directly targeting KuCoin users. The site is registered through the Webflow platform, which provides the front‑end hosting and automatically provisions a Cloudflare‑managed edge service. The site resolves to IP address 104.18.36.248, an address owned by Cloudflare, Inc., located in Canada. TLS termination is performed by a certificate issued by Google Trust Services under the WE1 authority, indicating the connection is encrypted but does not confer legitimacy. Detected technologies include Webflow, Cloudflare, and HTTP/3, confirming the use of modern web delivery mechanisms. Threat intelligence feeds flag the domain as high‑risk. VirusTotal reports 18 of 95 security vendors flagging the host, while Gridinsoft assigns a trust score of 0 out of 100. The domain appears on one public blocklist and has been blocked by PhishDestroy, reinforcing its classification as a cryptocurrency‑focused impersonation campaign. The HTTP response code is 200, confirming the page is being served without error. At present, no attribution to a specific threat actor or command‑and‑control infrastructure is available, and the registration details beyond the use of Webflow are not disclosed. Defenders should add kulcoinlogin.webflow.io to URL filtering and DNS sink‑hole rules, enforce MFA for KuCoin accounts, and monitor outbound traffic for connections to the Cloudflare IP range. Continuous re‑scanning of the domain is advised, given the active status and potential for further payload delivery.