kkucooin-sso[.]webflow[.]io

Analysis confirms that the domain kkucooin-sso.webflow.io is an active phishing infrastructure impersonating KuCoin, a cryptocurrency exchange. Registered on March 2, 2026, the domain remains operational as of July 12, 2026, returning an HTTP 200 status. Infrastructure analysis reveals hosting through Cloudflare (AS13335) with an IP resolution of 172.64.151.8, located in the United States. The page title explicitly states 'KuCoin Self-Service Login,' aligning with the identified brand impersonation target. The domain is constructed on the Webflow platform, a legitimate service often exploited for phishing due to its ease of deployment. Cloudflare's involvement provides the attacker with SSL encryption (certificate issued by Google Trust Services / WE1) and likely DDoS protection, complicating takedown efforts. Detection data indicates the domain appears on at least one security blocklist, and 15 of 93 security vendors on VirusTotal have flagged it as malicious. The Gridinsoft trust score of 0/100 further supports the assessment of high risk. While the exact content of the phishing page has not been analyzed, the combination of brand impersonation, cryptocurrency targeting, and active status suggests this is likely a credential harvesting or crypto-draining operation. Defenders should prioritize blocking the domain at the DNS and proxy levels, particularly in environments where cryptocurrency-related services are accessed. Monitoring for related subdomains or newly registered lookalike domains using the same infrastructure (Webflow + Cloudflare) may help identify additional threats from the same actor. No evidence currently links this domain to broader campaign infrastructure, but correlation with other KuCoin-themed phishing domains may reveal patterns in attacker behavior.