kconnlign[.]webflow[.]io

This domain, kconnlign.webflow.io, operates as a brand impersonation site designed to deceive users into disclosing login credentials for KuCoin, a major cryptocurrency exchange. The site presents a fraudulent login interface titled 'Kucoin *Login: Accessing Your Kucoin Account,' closely mimicking the legitimate platform's design to trick victims into entering sensitive account details. Such attacks typically lead to unauthorized access, financial theft, or further exploitation through malware deployment, particularly targeting users with active crypto holdings. Analysis indicates the domain was created on May 8, 2013, though the phishing content appears to have been hosted recently under the subdomain structure of webflow.io. The domain resolves to the IP address 104.18.36.248, associated with Cloudflare, Inc. (AS13335) in the United States. It is registered through MarkMonitor, Inc., a registrar commonly used for both legitimate and malicious domains. Security vendors have flagged the domain, with 17 out of 95 engines on VirusTotal detecting it as malicious. Additionally, the domain appears on two security blocklists: PhishDestroy and PhishingDB, further confirming its fraudulent nature. Users who visited kconnlign.webflow.io should immediately take corrective actions to mitigate potential risks. First, reset passwords for KuCoin and any other accounts where identical or similar credentials were used. Enable multi-factor authentication (MFA) on all financial and crypto-related platforms to add an extra layer of security. Monitor accounts for unauthorized transactions or suspicious activity, and report any anomalies to the affected service provider. If personal or financial information was entered, consider contacting relevant institutions to place fraud alerts on accounts. Finally, scan devices for malware using updated security tools to ensure no additional compromise occurred.