kuucoinloginc[.]webflow[.]io

This domain is flagged as a brand impersonation threat targeting KuCoin, a cryptocurrency exchange platform. The phishing page, titled 'KuCoin Login: How to Access Your Account Easily,' is designed to harvest user credentials by mimicking the legitimate KuCoin login interface. Analysis indicates an elevated risk level due to the domain's deliberate impersonation tactics and its presence on security blocklists.

Infrastructure analysis reveals the domain kuucoinloginc.webflow.io was registered through Webflow and resolves to the IP address 104.18.36.248, associated with AS13335 (Cloudflare, Inc.) in the United States. The domain was created on March 06, 2026, though this date may reflect a placeholder or misconfiguration. Security vendor detections on VirusTotal report 19 out of 95 engines flagging the domain as malicious. The SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious sites. The domain appears on a single security blocklist, specifically PhishDestroy, further confirming its classification as a phishing threat.

Mitigation steps for this brand impersonation threat include immediate blacklisting of the domain and associated IP address (104.18.36.248) across organizational security controls. Users should be educated to verify domain authenticity by inspecting URLs for subtle misspellings or unusual subdomains, such as 'kuucoinloginc' instead of the legitimate 'kucoin.com.' Multi-factor authentication (MFA) should be enforced for all cryptocurrency exchange accounts to mitigate the impact of credential theft. Security teams are advised to monitor for similar impersonation attempts, particularly those leveraging Webflow-hosted domains or Cloudflare IPs, and to report such incidents to relevant threat intelligence platforms for broader awareness.