secure--app-kucoin-sso--s-cdn[.]webflow[.]io

Analysis of the domain secure--app-kucoin-sso--s-cdn.webflow.io indicates active brand impersonation targeting KuCoin, a cryptocurrency exchange. The domain, registered on March 6, 2026, through MarkMonitor, Inc., resolves to the IP address 104.18.36.248, which is associated with AS13335 (Cloudflare, Inc.) in the United States. The site returns an HTTP 200 status and presents a page titled 'KuCoin: Sign-in | Access Your Crypto Portfolio,' directly mimicking KuCoin’s authentication interface. This alignment with the reported scam type—crypto scam—confirms the domain’s role in fraudulent credential harvesting or unauthorized asset transfer schemes. Infrastructure analysis reveals the use of Cloudflare hosting, a common tactic to obscure origin servers and evade takedowns. The SSL certificate, issued by Google Trust Services (WE1), provides a superficial layer of legitimacy but does not mitigate the underlying malicious intent. Detection metrics further support the domain’s malicious classification: it appears on one security blocklist, and 20 of 94 security vendors on VirusTotal flag the domain as malicious. The Gridinsoft trust score of 0/100 reinforces its high-risk status. Defenders should prioritize blocking or sinkholing this domain at the DNS or network level. Given its active status as of July 12, 2026, and its direct impersonation of a major cryptocurrency platform, user education campaigns should emphasize verifying domain authenticity before entering credentials. The domain’s registration through a reputable registrar (MarkMonitor) underscores the need for proactive monitoring of newly registered domains containing brand-related keywords, particularly those leveraging content delivery networks or third-party hosting services like Webflow. No evidence suggests this domain is affiliated with the legitimate KuCoin platform.