kucfinulogin[.]webflow[.]io

This domain is flagged for elevated-risk brand impersonation targeting KuCoin, a cryptocurrency exchange platform. Analysis indicates the site was designed to mimic legitimate KuCoin login portals, likely to harvest user credentials, API keys, or other sensitive authentication data. The threat type is classified as brand impersonation phishing, with a focus on financial fraud and unauthorized account access. Infrastructure analysis reveals the domain kucfinulogin.webflow.io was registered through MarkMonitor, Inc. on March 07, 2026, and resolved to IP address 172.64.151.8, hosted on Cloudflare’s network (AS13335). The page title, 'Kucoin Login: Accessing Your Kucoin Account - Webflow,' explicitly references KuCoin’s branding. Security vendors on VirusTotal detected the domain as malicious, with 18 out of 95 engines flagging it. The domain appears on one security blocklist and was previously blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), a common practice among phishing sites to appear legitimate. The domain is currently offline, but prior activity and detection rates indicate a deliberate attempt to deceive users. Mitigation steps for this threat type include immediate domain blacklisting in enterprise security gateways and endpoint protection systems. Organizations should monitor for any residual DNS queries or cached references to the domain. Users who may have interacted with the site should be advised to reset KuCoin account credentials, revoke active API keys, and enable multi-factor authentication. Security teams should review logs for connections to 172.64.151.8 or related Cloudflare IPs during the domain’s active period. Given the elevated risk, proactive threat hunting for similar Webflow-hosted impersonation domains is recommended, particularly those mimicking financial or cryptocurrency platforms.