kuckoinleogin[.]webflow[.]io

This domain, kuckoinleogin.webflow.io, is flagged as a brand impersonation threat specifically targeting KuCoin, a major cryptocurrency exchange. Analysis indicates the site replicates the official KuCoin login interface, using the page title 'Kucoin Login: Accessing Your Kucoin Account' to deceive users into submitting credentials. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with credential theft campaigns designed to compromise accounts for subsequent unauthorized transactions or asset theft. Infrastructure analysis reveals the domain was registered on April 19, 2026, through Webflow, a platform commonly exploited for hosting fraudulent pages. It resolves to the IP address 104.18.36.248, associated with Cloudflare, Inc. in Canada, a frequent choice for threat actors seeking anonymity. The domain appears on one security blocklist and is flagged by 21 out of 95 vendors on VirusTotal, indicating moderate to high confidence in its malicious nature. The SSL certificate, issued by Google Trust Services (WE1), provides no inherent trust, as such certificates are routinely abused in phishing operations. No Google Safe Browsing (GSB) block was recorded at the time of assessment, though this does not diminish the elevated risk. As of the latest verification, kuckoinleogin.webflow.io has been taken offline, likely due to enforcement actions by security providers or the hosting platform. However, the risk of reemergence remains, as threat actors frequently rotate domains or repurpose infrastructure. Users who may have interacted with this domain are advised to immediately reset their KuCoin credentials, enable multi-factor authentication, and monitor their accounts for unauthorized activity. Organizations should update blocklists to include this domain and its associated indicators, such as the IP address and SSL certificate thumbprint, to prevent future access attempts.