kouiikoxulogin[.]webflow[.]io

This domain, kouiikoxulogin.webflow.io, was identified as a credential phishing site designed to impersonate the KuCoin cryptocurrency exchange login portal. Visitors were presented with a fraudulent login interface mimicking the legitimate KuCoin platform, where entering credentials would result in immediate theft by threat actors. The page title, 'Ku𝕮𝖔𝖔n LoǤᎥᑎ%^: Seamlessly Accessing Your Cryptocurrency Universe,' used Unicode manipulation to evade basic detection and appear authentic to unsuspecting users. Such tactics are commonly employed to harvest login details for unauthorized access to cryptocurrency wallets and exchange accounts, leading to financial loss and account compromise. Analysis indicates the domain was registered through NameCheap, Inc. on February 22, 2026, and resolved to the IP address 104.18.36.248, hosted on Cloudflare’s infrastructure (AS13335). The site was flagged by 17 out of 95 security vendors on VirusTotal, confirming its malicious nature. Additionally, it appeared on one security blocklist and was subsequently blocked by network-level protections. The SSL certificate, issued by Google Trust Services (WE1), provided a false sense of security, as phishing sites frequently use valid certificates to appear legitimate. The domain’s creation date in the future (2026) suggests potential typosquatting or domain spoofing techniques to exploit user trust in established brands. Users who visited kouiikoxulogin.webflow.io and entered credentials should assume their login details have been compromised. Immediate action is required: change passwords for the affected account and any other platforms where the same credentials were reused. Enable multi-factor authentication (MFA) on all cryptocurrency-related accounts to prevent unauthorized access. Monitor account activity for suspicious transactions and report any unauthorized access to the legitimate platform’s support team. If financial loss is detected, contact local law enforcement and relevant financial authorities to initiate an investigation. Avoid interacting with any links or communications related to this domain, as threat actors may attempt follow-up attacks via email or messaging platforms.