kuucainlogin[.]webflow[.]io

The domain kuucainlogin.webflow.io has been identified as a credential phishing site specifically designed to impersonate the KuCoin cryptocurrency exchange platform. Analysis confirms the domain was actively harvesting user credentials through a fraudulent login interface titled 'KuCōin Sign i𝒏 | Easy Steps to Access Your Account.' The site is currently offline, but prior activity indicates a targeted effort to deceive users into submitting sensitive account information. Infrastructure analysis reveals the domain was registered through Webflow and resolved to the IP address 172.64.151.8. Security assessments show it was flagged by 19 of 95 vendors on VirusTotal, while Gridinsoft assigned a trust score of 0 out of 100. The domain appeared on one security blocklist and was blocked by at least one anti-phishing system. Technologies detected include Webflow for hosting, Cloudflare for content delivery, and HTTP/3 for network communication. The SSL certificate was issued by Google Trust Services, a common feature in phishing campaigns to appear legitimate. Current status indicates the domain has been taken offline, reducing immediate risk to users. However, organizations and individuals should remain vigilant for similar impersonation attempts. Recommended actions include blocking the domain and associated IP address (172.64.151.8) at the network level, monitoring for credential exposure, and educating users on identifying phishing indicators such as unusual domain names, misspellings in page titles, and unsolicited login requests. Security teams should also review logs for any prior interactions with this domain to assess potential compromise.