kciuinlocun[.]webflow[.]io

This domain, kciuinlocun.webflow.io, poses an elevated threat through brand impersonation targeting KuCoin, a major cryptocurrency exchange platform. Analysis indicates the domain replicates KuCoin’s official login interface, including identical page titles such as 'Crypto Exchange | Bitcoin Exchange | Bitcoin Trading | KuCoin,' to deceive users into submitting sensitive credentials, including usernames, passwords, and two-factor authentication codes. The objective appears to be unauthorized access to cryptocurrency wallets and financial theft, a common tactic in phishing campaigns targeting digital asset holders. Infrastructure analysis reveals the domain was registered through MarkMonitor, Inc. on March 6, 2026, though this date may reflect placeholder or falsified registration data. The domain resolves to IP address 104.18.36.248, located within the United States and associated with AS13335, Cloudflare, Inc. Security vendor detection metrics indicate 18 out of 95 engines flagged the domain as malicious on VirusTotal. Additionally, the domain appears on one security blocklist and is currently classified as offline. The SSL certificate, issued by Google Trust Services under the WE1 root, does not mitigate the underlying malicious intent. Users who accessed kciuinlocun.webflow.io should immediately revoke any entered credentials and enable multi-factor authentication on their legitimate KuCoin accounts. All sessions should be terminated, and a password reset initiated from KuCoin’s official domain. Devices used to access the phishing site should undergo malware scanning to detect potential secondary infections. Cryptocurrency wallet addresses linked to the account should be reviewed for unauthorized transactions, and users are advised to monitor for suspicious activity across all financial platforms.