cuconlogin[.]webflow[.]io

Analysis of the domain cuconlogin.webflow.io indicates it is a crypto-focused phishing site targeting users of the KuCoin exchange. The domain, hosted on Cloudflare infrastructure (AS13335, US), was flagged by 14 of 95 security vendors on VirusTotal and appears on the PhishDestroy blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and malicious sites. The page title, 'Ku𝐂oin: % Log In | Sign In,' directly impersonates KuCoin, using a Unicode character substitution to evade basic detection filters. Scamadviser assigned a trust score of 1/100, reinforcing its fraudulent classification.

Infrastructure analysis reveals the domain was created on May 8, 2013, and registered through MarkMonitor, Inc., though this does not imply legitimacy given the domain's repurposing for malicious activity. The site resolves to an IPv6 address (2606:4700:440c::ac40:9709) and uses Cloudflare nameservers (journey.ns.cloudflare.com, lamar.ns.cloudflare.com). At the time of assessment, the domain returned an HTTP 403 status, suggesting it was taken offline or restricted, though this does not preclude future reactivation. Defenders should treat this domain as a confirmed threat.

The combination of brand impersonation, low trust scores, and blocklist presence provides strong evidence of malicious intent. Organizations should block the domain, its resolved IP, and monitor for related infrastructure, particularly those using Webflow and Cloudflare with similar naming patterns. No evidence suggests this is part of a broader campaign, but the use of Unicode spoofing in the page title may indicate an attempt to bypass automated defenses. Further investigation into the domain's historical activity and associated wallets or redirect chains is recommended for comprehensive mitigation.