kquckontlgi[.]webflow[.]io

This domain is flagged as an elevated-risk phishing resource specifically engineered to harvest user credentials by impersonating the KuCoin cryptocurrency exchange login interface. Analysis indicates the page title, 'Ku𝐂oin* Login - Guide Easy Steps to Access Your Account,' employs subtle Unicode character manipulation to deceive users into believing they are accessing a legitimate service. The threat type is classified as generic_phishing with a focus on credential theft, targeting individuals with active cryptocurrency accounts. Infrastructure analysis reveals the domain kquckontlgi.webflow.io was registered through Webflow and currently resolves to the IP address 172.64.151.8, geolocated to Canada under Cloudflare, Inc. The domain was created on March 22, 2026, though this date may reflect misconfiguration or intentional obfuscation. Detection metrics indicate the resource is flagged by 22 out of 95 security vendors on VirusTotal and appears on one security blocklist, specifically PhishDestroy. Despite its current offline status, the domain's detection history and infrastructure suggest a deliberate attempt to evade initial scrutiny while maintaining operational readiness. Mitigation against this threat requires immediate user education on recognizing Unicode-based spoofing in domain names and page titles. Organizations should implement email and web filtering rules to block domains hosted on Webflow with recent creation dates, particularly those resolving to Cloudflare IP ranges. Users who may have interacted with this domain should reset their credentials via official channels and enable multi-factor authentication. Security teams are advised to monitor for additional domains leveraging similar Unicode manipulation techniques or identical infrastructure patterns, as this campaign may represent a broader credential harvesting operation.