kucoinzloguin[.]webflow[.]io

The domain kucoinzloguin.webflow.io is identified as a brand impersonation threat specifically designed to mimic the official KuCoin cryptocurrency exchange login portal. Analysis indicates this infrastructure is engineered to harvest user credentials under the guise of legitimate account access. The site is currently offline, but prior activity confirms its malicious intent as a fake login page targeting KuCoin customers. Technical indicators reveal the domain was flagged by 20 of 95 security vendors on VirusTotal, a notable detection rate for phishing infrastructure. It was registered through Webflow, a platform frequently abused for rapid deployment of fraudulent sites due to its ease of use and free hosting capabilities. The domain resolves to the IP address 104.18.36.248, which is associated with Cloudflare, Inc. in Canada, a common proxy service used to obscure the true origin of malicious infrastructure. The page title, 'Kucoin *Login: Accessing Your Kucoin Account,' directly impersonates the official KuCoin branding, further corroborating its fraudulent purpose. The domain appears on one security blocklist and was actively blocked by at least one threat intelligence feed prior to takedown. Current status confirms the domain has been taken offline, likely due to enforcement actions by the hosting provider or security teams. However, the risk remains elevated for users who may have interacted with the site before its removal. Organizations and individuals are advised to monitor for unauthorized access to cryptocurrency wallets or exchange accounts, particularly those linked to KuCoin. Users should verify the authenticity of login portals by cross-referencing official domain names and enabling multi-factor authentication (MFA) to mitigate credential theft risks. Security teams are encouraged to update blocklists with the domain and IP address to prevent residual exposure from cached or mirrored instances.