kucoinlogin[.]webflow[.]io

PhishDestroy identifies kucoinlogin.webflow.io as an active brand impersonation domain targeting KuCoin users. This domain is currently live and designed to mimic the legitimate KuCoin login portal, tricking visitors into divulging their authentication credentials or personal information. The threat is categorized as elevated due to the realistic replication of KuCoin's branding and the likelihood of credential harvesting.

This domain resolves to IP 104.18.36.248 and is flagged by 16 of 95 VirusTotal security vendors, indicating significant malicious detection. The domain uses a Google Trust Services SSL certificate, which may appear legitimate at first glance. VirusTotal detection includes multiple engines identifying the site as a phishing or impersonation lure. The IP address is associated with known malicious activity and is consistent with infrastructure previously linked to credential theft campaigns. The domain is hosted on Webflow, a legitimate service platform, but is being abused for impersonation purposes. The combination of high VirusTotal detection rate, active status, and impersonation of a major cryptocurrency exchange increases the risk to users.

Given the active status and confirmed malicious indicators, users are strongly advised not to interact with kucoinlogin.webflow.io. If you have accessed this domain, do not enter any login credentials, API keys, or personal information. Review your KuCoin account for suspicious activity and enable two-factor authentication if not already active. Report this domain to KuCoin’s security team and consider changing passwords across other platforms if credentials were reused. Use ad blockers and browser-based security extensions to reduce exposure to similar threats. Organizations should consider blocking this domain and IP at the network level to prevent accidental access.