kucoiin-log-in[.]webflow[.]io

This domain, kucoiin-log-in.webflow.io, is flagged for brand impersonation targeting KuCoin, a major cryptocurrency exchange platform. Analysis indicates the site was designed to mimic the official KuCoin login interface, likely to harvest user credentials or facilitate unauthorized account access. The page title, 'KuCoin: Log In | Sign In | Webflow,' directly mirrors legitimate login portals, increasing the likelihood of successful deception. No explicit drainer kit signatures were identified, but the infrastructure aligns with credential harvesting tactics commonly employed in phishing campaigns. Infrastructure analysis reveals the domain was registered through Webflow and resolved to IP address 172.64.151.8, hosted under Cloudflare, Inc. in Canada. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the malicious intent, as phishing sites frequently leverage legitimate certificates to appear trustworthy. The domain was created on April 09, 2026, and has been flagged by 21 out of 95 security vendors on VirusTotal. It appears on one security blocklist and was previously blocked by PhishDestroy. Google Safe Browsing status is not explicitly stated, but the detection volume suggests it was likely flagged. The domain is currently offline, reducing immediate risk to end users. However, the infrastructure remains a potential vector for future malicious activity, particularly if the domain is reactivated or repurposed. Response actions include takedown measures by the hosting provider, though residual risk persists due to the domain's prior association with phishing. Users who interacted with the site should assume credential exposure and initiate password resets, enable multi-factor authentication, and monitor accounts for unauthorized activity. Organizations should update blocklists and educate users on identifying brand impersonation tactics, particularly in cryptocurrency-related phishing schemes.