kuccoenllogiin[.]webflow[.]io

kuccoenllogiin.webflow.io is identified as a high-risk domain engaged in brand impersonation, targeting the cryptocurrency exchange KuCoin. The domain was created on March 7, 2026, and currently remains active. Analysis reveals that it has a notably low trust score of 0 out of 100 as per Gridinsoft metrics. The domain's page title, 'KuCoin Login - A Step-by-tep Guide to Access Your Account', explicitly aims to mislead users into believing it is an official KuCoin login page. This indicates an intent to harvest user credentials by manipulating brand recognition.

Infrastructure analysis indicates that the domain is registered through Webflow and utilizes Cloudflare for its hosting service, which may enhance its resilience against takedown attempts. The domain resolves to the IP address 172.64.151.8. Security assessments from VirusTotal show that 19 out of 95 security vendors have flagged this domain, underscoring its malicious nature. Furthermore, it appears on one known security blocklist and has been blocked by PhishDestroy, highlighting active defensive measures against it.

The SSL certificate is issued by Google Trust Services, which could grant a false sense of security to potential victims. However, the presence of an SSL certificate does not guarantee legitimacy, especially in cases of phishing. Given the malicious intent demonstrated through various indicators, network defenders should take immediate actions, including blocking access to this domain across their networks and implementing user awareness campaigns to educate about the risks associated with brand impersonation.

As the domain is still operational, continuous monitoring is recommended to assess any changes in its status or infrastructure. Further intelligence gathering may be necessary to understand the broader scope of this campaign and its potential impacts on users and the brand being impersonated.