kuco-icclogin[.]webflow[.]io

This domain is flagged for elevated-risk brand impersonation, specifically targeting KuCoin users through a fraudulent login portal. The threat type involves credential harvesting under the guise of legitimate authentication pages, as evidenced by the page title 'Kucoin Login#$: Accessing Your Kucoin Account,' designed to deceive users into submitting sensitive account details. Analysis indicates the domain kuco-icclogin.webflow.io was registered on February 21, 2026, through NameCheap, Inc. and resolved to the IP address 172.64.151.8, hosted on Cloudflare’s infrastructure (AS13335). VirusTotal reports 17 out of 95 security vendors flagging the domain as malicious. It appears on one security blocklist and was previously blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), which does not mitigate the domain’s fraudulent intent. Infrastructure review confirms the domain was taken offline, though its prior activity remains a concern for retrospective threat hunting. Mitigation steps for this brand impersonation threat include immediate blacklisting of the domain and its resolving IP (172.64.151.8) across all network security controls. Organizations should deploy indicators of compromise (IOCs) in endpoint detection and response (EDR) systems and web proxies. User awareness training should emphasize verifying domain authenticity before entering credentials, particularly for financial platforms. Security teams are advised to monitor for residual phishing attempts using similar naming conventions (e.g., 'kuco-*' or 'icclogin') and to review logs for prior interactions with this domain or its associated IP address.