kucoiguunellin[.]webflow[.]io

PhishDestroy identified kucoiguunellin.webflow.io as a generic phishing domain targeting cryptocurrency users through a KuCoin brand impersonation. The site was designed to steal login credentials by mimicking the legitimate KuCoin authentication portal, complete with a deceptive page titled 'Ku𝐂oin* Login - Guide Easy Steps to Access Your Account - Webflow.' This threat falls under credential theft, as it specifically aimed to capture usernames and passwords for unauthorized access to victims' accounts.

Technical analysis reveals that the domain resolves to IP address 104.18.36.248 and was created on April 4, 2026, indicating a recent deployment. VirusTotal data shows 16 out of 95 security vendors flagged the domain as malicious, and it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), and the domain is registered through Webflow. Notably, Google Safe Browsing did not list this domain, meaning it may have evaded some automated protections.

As of the latest check, the domain has been taken offline, effectively neutralizing the immediate threat. PhishDestroy recommends that users who may have entered credentials on this site change their KuCoin passwords immediately and enable two-factor authentication. While the site is offline, the risk of credential reuse on other platforms remains, so affected users should monitor for suspicious activity and use unique passwords across all services.