kucoinhzlogin[.]webflow[.]io

This domain, kucoinhzlogin.webflow.io, is assessed as an elevated-risk crypto phishing site targeting KuCoin, a known cryptocurrency exchange. Infrastructure analysis reveals the domain was created on May 8, 2013, though its use in malicious activity appears more recent, given the 2023 reference in the page title 'KuCoin login| Review 2023.' The domain is currently offline, returning an HTTP 404 status, and is hosted behind Cloudflare (AS13335), resolving to IP 172.64.151.8 in the United States. SSL certification is provided by Google Trust Services (WE1), a common feature in both legitimate and fraudulent sites leveraging Cloudflare’s infrastructure. Detection data indicates the domain is flagged by 14 of 95 security vendors on VirusTotal, a notable but not definitive indicator of malicious intent.

It appears on one security blocklist and is blocked by PhishDestroy. The domain was registered through MarkMonitor, Inc., a registrar frequently used for both legitimate and fraudulent domains. Nameservers (journey.ns.cloudflare.com, lamar.ns.cloudflare.com) further confirm Cloudflare’s role in its hosting and DNS management. While the domain’s registration date predates typical phishing campaigns, the page title explicitly references KuCoin and a 2023 review, suggesting an attempt to impersonate the exchange for credential harvesting or fraudulent transactions.

The use of Webflow, a legitimate website builder, is consistent with phishing tactics that exploit trusted platforms to evade detection. Defenders should treat this domain as a confirmed threat vector for KuCoin users and consider proactive blocking at the DNS or network level. Further investigation into associated infrastructure, such as linked IPs or domains, may uncover additional malicious activity. Given its current offline status, monitoring for reactivation or shifts to alternative hosting is recommended.