kinucoininlogin[.]webflow[.]io

This domain, kinucoininlogin.webflow.io, is flagged as a high-risk brand impersonation threat targeting KuCoin. The domain was registered through Webflow and created on February 17, 2026, which aligns with the recent rise in phishing attacks against cryptocurrency platforms. The page title, 'KuCoin Login | How to Access Your Account Easily,' is designed to deceive users into believing they are accessing an official KuCoin login page, making it a significant risk for unsuspecting visitors. Analysis indicates that the domain resolves to IP address 104.18.36.248 and is currently active, suggesting that the threat is ongoing and the site may be actively harvesting credentials or other sensitive information from users. The SSL certificate, issued by Google Trust Services, is a common tactic used by threat actors to gain user trust, but it does not guarantee the site's legitimacy. Defenders should be wary of the high Gridinsoft trust score of 0/100, which is indicative of a high level of suspicion. Additionally, the domain appears on three security blocklists, including PhishDestroy, OISD, and BLP-Malware, further confirming its malicious nature. Given the high risk and active status, it is crucial for defenders to block access to this domain and educate users about the signs of brand impersonation attacks, particularly those targeting popular cryptocurrency platforms like KuCoin. Infrastructure analysis reveals the use of Webflow and Cloudflare, which are legitimate services but can be abused by cybercriminals. The presence of HTTP/3 technology suggests that the site is well-optimized and may appear more credible to users. Defenders should also monitor for any attempts to use this domain in phishing campaigns and consider implementing additional security measures, such as multi-factor authentication, to protect users from credential theft.