kuucoianlogin[.]webflow[.]io

The domain kuucoianlogin.webflow.io has been identified as a brand impersonation phishing site targeting KuCoin, a cryptocurrency exchange platform. Analysis indicates the domain was designed to mimic the official KuCoin login portal, as evidenced by its page title, 'KuCoin Login | Access Your Account Easily.' The domain is currently offline, but prior activity suggests it was actively used for credential harvesting or account takeover attempts. Infrastructure analysis reveals the domain was registered on May 08, 2013, through MarkMonitor, Inc., a registrar commonly associated with legitimate corporate domains. It resolved to the IP address 172.64.151.8, hosted on infrastructure belonging to Cloudflare, Inc. (AS13335) in the United States. The domain was flagged by 17 of 95 security vendors on VirusTotal, indicating a moderate-to-high confidence level in its malicious classification. Additionally, it appeared on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate was issued by Google Trust Services (WE1), which, while not inherently malicious, is often leveraged by threat actors to lend legitimacy to phishing pages. Current status confirms the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the infrastructure and registration details suggest the potential for reemergence under a similar or altered domain. Organizations and users are advised to monitor for domains impersonating KuCoin, particularly those using Cloudflare-hosted infrastructure or registered through corporate registrars. Network-level blocking of the IP 172.64.151.8 and domains with similar naming patterns is recommended as a preventive measure. End-users should verify the authenticity of login portals by cross-referencing URLs with official sources and enabling multi-factor authentication to mitigate credential theft risks.