kucontnlggin[.]webflow[.]io

The domain kucontnlggin.webflow.io has been identified as a brand-impersonation phishing resource specifically targeting KuCoin, a cryptocurrency exchange platform. Analysis indicates this domain presents a fraudulent login interface designed to harvest user credentials under the guise of legitimate KuCoin account access. As of the latest assessment, the domain has been taken offline, though prior activity remains a documented threat vector. Infrastructure analysis reveals the domain was registered through Webflow on April 28, 2026, an anomalous creation date suggesting potential domain squatting or preemptive registration for malicious use. The domain resolves to the IP address 172.64.151.8, associated with Cloudflare, Inc. in Canada, a common proxy service leveraged to obscure hosting origins. Detection metrics indicate the domain was flagged by 20 of 95 security vendors on VirusTotal, reflecting elevated suspicion across multiple detection engines. Additionally, the domain appears on one security blocklist, further corroborating its malicious classification. The SSL certificate, issued by Google Trust Services (WE1), provides a veneer of legitimacy but does not mitigate the underlying phishing risk. Current status confirms the domain is offline, though residual threat potential persists due to the transient nature of such campaigns. Organizations and users are advised to implement proactive measures, including real-time domain monitoring for similar impersonation attempts, enforcement of multi-factor authentication on cryptocurrency platforms, and validation of SSL certificates against known legitimate issuers for the targeted brand. Network-level blocking of the identified IP (172.64.151.8) and associated domains registered through Webflow during the same timeframe is recommended to mitigate recurrence. End-users should verify domain authenticity via official communication channels prior to entering credentials on any financial or cryptocurrency platform.