kiucoinlogini[.]webflow[.]io

This domain, kiucoinlogini.webflow.io, is flagged for credential phishing activity targeting cryptocurrency exchange users. Analysis indicates the page mimics the official KuCoin login interface, using a deceptive title, KuCōin® - 𝐋 𝒈 𝐈𝙣 - 𝑺î𝗴𝒏 i𝒏, to trick victims into submitting sensitive account credentials. The threat type is classified as elevated due to the direct financial impact of compromised cryptocurrency accounts and the use of obfuscation techniques in the page title. Infrastructure analysis reveals the domain is hosted on Cloudflare’s network, resolving to IP address 172.64.151.8 (AS13335). The domain was registered through MarkMonitor, Inc., a registrar commonly used for legitimate and malicious domains alike. Detection metrics show 18 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on at least one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a valid but frequently abused certificate authority in phishing campaigns. Notably, the domain creation date is listed as March 07, 2026, suggesting either a typographical error in records or an attempt to evade age-based detection heuristics. Mitigation steps for this threat include immediate blocking of the domain and its associated IP address across network security controls. Organizations should deploy email and web filtering rules to prevent users from accessing the domain, particularly in environments where cryptocurrency-related services are accessed. End-users should be educated on identifying obfuscated or misspelled domain names, such as the use of Unicode characters in kiucoinlogini.webflow.io, which deviates from the legitimate kucoin.com. Multi-factor authentication (MFA) should be enforced for all cryptocurrency exchange accounts to mitigate the impact of credential theft. Security teams are advised to monitor for similar domains registered through MarkMonitor or hosted on Cloudflare infrastructure, as these may indicate ongoing or evolving phishing campaigns.