kucoin-login-authh[.]webflow[.]io

This domain is flagged as an elevated-risk credential harvesting phishing site specifically designed to impersonate KuCoin, a major cryptocurrency exchange platform. The infrastructure analysis reveals a targeted attempt to deceive users into submitting sensitive account credentials, including usernames, passwords, and potentially two-factor authentication codes, through a fraudulent login interface mimicking the official KuCoin portal. Analysis indicates the domain kucoin-login-authh.webflow.io was registered on February 21, 2026, through NameCheap, Inc., and resolves to IP address 172.64.151.8, hosted on Cloudflare’s network (AS13335). The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate, is commonly exploited by threat actors to lend false credibility. Security vendors on VirusTotal flagged this domain at a rate of 17 out of 95, and it appears on at least one security blocklist, specifically PhishDestroy. The page title, 'Log In | Kucoin (Official Site)® - Sign In to Your Account™,' further confirms the intent to impersonate the legitimate KuCoin brand with high fidelity. Mitigation against credential harvesting threats of this nature requires immediate action from both users and security teams. Users who may have interacted with this domain should reset their KuCoin account credentials from a verified source and enable multi-factor authentication if not already active. Security teams are advised to block the domain and associated IP address (172.64.151.8) at the network perimeter, update endpoint detection rules to flag any access attempts, and monitor for indicators of compromise, including anomalous login attempts or unauthorized transactions. Given the domain’s current offline status, continuous monitoring for re-emergence or similar infrastructure is recommended, as threat actors frequently re-deploy phishing sites under new domains or hosting providers.