kuccoin-custtomeer-serrvice-nnumber[.]webflow[.]io

This domain, kuccoin-custtomeer-serrvice-nnumber.webflow.io, operates as a confirmed brand impersonation phishing site targeting KuCoin users. The page presents itself as a legitimate customer service portal, displaying fraudulent contact details and account access prompts under the guise of official KuCoin support. Analysis of the page title reveals deliberate misspellings (e.g., 'KKucoiin-Custommer-Supporrt-Number') designed to evade detection while mimicking the targeted brand's identity. The primary threat involves social engineering tactics to harvest sensitive credentials, including login details, two-factor authentication codes, or private keys, which could lead to unauthorized account access or asset theft on the KuCoin platform. Technical evidence confirms the malicious nature of this domain. The domain is flagged by 14 out of 95 security vendors on VirusTotal, indicating widespread detection as a phishing resource. Infrastructure analysis reveals registration through MarkMonitor, Inc., with an initial creation date of May 08, 2013, though the malicious subdomain likely emerged recently. The domain appears on two security blocklists (PhishDestroy and PhishingDB) and resolves to Cloudflare infrastructure (AS13335) via IPv6 address 2606:4700:440c::ac40:9708. The SSL certificate, issued by Google Trust Services (WE1), provides encrypted connections but does not validate the legitimacy of the underlying phishing content. The current status of the domain is offline, though historical activity remains a concern. Users who visited this domain or interacted with its content should take immediate remediation steps. First, revoke any active sessions or API keys associated with KuCoin accounts, particularly if credentials were entered on the site. Enable multi-factor authentication (MFA) using a hardware-based or app-based solution, avoiding SMS-based methods if possible. Monitor account activity for unauthorized transactions or configuration changes, and report suspicious activity directly to the official KuCoin security team. If financial assets were transferred or private keys exposed, consider migrating funds to a new wallet address. Additionally, scan local devices for malware, as phishing sites may distribute secondary payloads. Organizations should update internal blocklists to include this domain and its associated indicators to prevent future access.