kucoinnlogginn[.]webflow[.]io

Analysis of kucoinnlogginn.webflow.io indicates a brand‑impersonation campaign targeting KuCoin. The site’s HTML title is “KuCoin Login | Sign In To KuCoin”, directly referencing the exchange. The domain resolves to 172.64.151.8, an address owned by Cloudflare (AS13335) located in the United States. Both authoritative nameservers, journey.ns.cloudflare.com and lamar.ns.cloudflare.com, are Cloudflare‑managed, confirming the hosting provider. The SSL certificate is issued by Google Trust Services under the WE1 intermediate, providing a valid TLS chain that may lend superficial credibility to visitors.

The HTTP response returns a 404 status, suggesting the page is no longer serving content, and the domain is presently listed as offline. Registration data shows the domain was created on May 08 2013 and was registered through MarkMonitor, Inc., a registrar often used by legitimate enterprises, which may be an attempt to obscure malicious intent. VirusTotal analysis shows 13 of 95 scanned security vendors flagged the domain, indicating a moderate detection rate across independent tools. The domain appears on one public security blocklist and is actively blocked by PhishDestroy, demonstrating that at least some threat‑intelligence feeds have incorporated it. Detected technologies include Cloudflare and HTTP/3, consistent with the underlying hosting infrastructure but not indicative of malicious functionality.

The available evidence confirms the domain’s role in a crypto‑related impersonation attempt, yet the exact payload or credential‑harvesting mechanism remains unknown because the page content is not reachable. Defenders should add the domain to internal blocklists, monitor DNS queries for the IP 172.64.151.8, and enforce strict URL filtering for any requests containing the “kucoinnlogginn.webflow.io” suffix. Continuous scanning of the IP range owned by Cloudflare is advisable, as the provider hosts many unrelated services.