aqkukoinlogin[.]webflow[.]io

This domain, aqkukoinlogin.webflow.io, is flagged for brand_impersonation targeting Ethereum, a prominent cryptocurrency platform. The site mimics legitimate KuCoin branding, as evidenced by its page title, 'KuCoin: Crypto Exchange | Bitcoin Exchange | Bitcoin Trading,' likely to deceive users into divulging credentials or transferring assets. No specific drainer kit has been confirmed, but the domain exhibits characteristics consistent with credential harvesting or wallet-drain schemes. Analysis indicates the domain was registered on February 21, 2026, through NameCheap, Inc., and resolves to IP address 104.18.36.248, hosted on Cloudflare's infrastructure (AS13335). VirusTotal reports 18/95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is currently blocked by at least one threat intelligence feed. Its SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy to phishing sites. As of the latest assessment, the domain remains active and poses an elevated risk to users. Response actions include its inclusion in blocklists and detection by multiple security vendors, though evasion techniques such as IP rotation or domain flux may prolong its operational status. Users are advised to verify domain authenticity before interacting with cryptocurrency-related sites, particularly those soliciting login credentials or wallet access. Monitoring for further infrastructure changes, such as shifts in hosting providers or SSL certificate updates, is recommended to track potential evasion attempts.