cocoenlogin[.]webflow[.]io

This domain cocoenlogin.webflow.io is assessed as a brand impersonation page designed to mimic KuCoin authentication services. The page title 'Login @Kucoin - Accessing Your KuCōin Account* Easily%' indicates deliberate visual and textual mimicry intended to mislead users into entering exchange credentials. The infrastructure behavior is consistent with credential harvesting campaigns targeting cryptocurrency account holders.

Technical evidence shows multiple independent risk indicators. VirusTotal reports 17/95 security vendors flagging the domain as malicious or suspicious. The domain was created on February 21, 2026 and registered through NameCheap, Inc. It resolves to IP 104.18.36.248 under AS13335 Cloudflare, Inc. SSL certificate is issued by Google Trust Services / WE1. The domain appears on 1 security blocklist and is currently marked as offline, indicating containment after detection.

Users who interacted with this domain should assume potential credential compromise. Immediate remediation includes resetting exchange passwords, revoking active sessions, and enabling multi-factor authentication. Any stored API keys should be invalidated to prevent unauthorized trading activity. Endpoint checks are recommended to rule out malware or token theft. Financial accounts should be monitored for unauthorized withdrawals, as impersonation infrastructure of this type is commonly used for account takeover and asset extraction attempts.