oincoinkulo[.]webflow[.]io

This domain is flagged as a brand impersonation site designed to steal login credentials from users attempting to access KuCoin, a major cryptocurrency exchange. The page mimics the official KuCoin login interface, tricking victims into entering their account details, which are then harvested by threat actors. Such credential theft can lead to unauthorized access, financial loss, and further exploitation of linked accounts or assets. Analysis indicates the domain was created on February 21, 2026, and is registered through NameCheap, Inc. It resolves to an IP address (104.18.36.248) hosted on Cloudflare’s infrastructure (AS13335), a common tactic to obscure the true origin of malicious sites. Security vendors on VirusTotal have detected this domain, with 18 out of 95 flagging it as malicious. The SSL certificate, issued by Google Trust Services, does not mitigate the risk, as encrypted connections are frequently exploited in phishing campaigns to appear legitimate. Users who visited oincoinkulo.webflow.io should assume their credentials were compromised. Immediately change the password for any KuCoin account accessed via this domain and enable multi-factor authentication if not already active. Monitor the account for unauthorized transactions or suspicious activity. Additionally, scan the device used to access the site for malware, as credential theft sites may deploy additional payloads. Report the incident to KuCoin’s official support channels to assist in mitigating potential fraud.