kukuoeinlogin[.]webflow[.]io

This domain, kukuoeinlogin.webflow.io, is flagged as a credential phishing site specifically targeting users of the KuCoin cryptocurrency exchange. The page, titled 'KuCoin Login: How to Access Your Account Easily,' mimics the legitimate KuCoin login interface to harvest user credentials, including usernames, passwords, and potentially two-factor authentication codes. Such infrastructure is commonly deployed in campaigns aimed at stealing digital assets or conducting unauthorized transactions from compromised accounts. Analysis indicates this domain was designed to exploit trust in the KuCoin brand, leveraging social engineering tactics to deceive users into submitting sensitive information. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NameCheap, Inc., and resolved to the IP address 172.64.151.8, hosted on Cloudflare’s network (AS13335). The domain appears on one security blocklist and is flagged by 16 out of 95 security vendors on VirusTotal, indicating a consensus among detection engines regarding its malicious nature. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing sites frequently use valid certificates to appear legitimate. The domain’s current status is offline, suggesting takedown actions or voluntary suspension by the threat actor. Users who visited kukuoeinlogin.webflow.io or entered credentials on this site should assume their account details have been compromised. Immediate actions include changing passwords for KuCoin and any other platforms where identical credentials were reused. Enable multi-factor authentication (MFA) on all accounts, preferably using an authenticator app rather than SMS-based verification. Monitor KuCoin account activity for unauthorized transactions and report any suspicious activity to the exchange’s support team. Additionally, consider revoking access to any linked API keys or third-party applications. If financial losses are detected, report the incident to relevant authorities and provide all available technical indicators, including the domain, IP address, and SSL certificate details.