kucoinlogino[.]webflow[.]io

The domain kucoinlogino.webflow.io is identified as a credential theft infrastructure specifically targeting users of the KuCoin cryptocurrency exchange platform. Analysis confirms the domain is currently offline, though it previously hosted a fraudulent login portal mimicking the legitimate KuCoin interface. The threat type is classified as brand impersonation, designed to harvest user credentials for unauthorized account access and potential financial theft. Infrastructure analysis reveals the domain was registered through MarkMonitor, Inc. on May 08, 2013, though its malicious use appears more recent. It resolves to the IP address 172.64.151.8, hosted on Cloudflare, Inc. infrastructure (AS13335) located in the United States. The SSL certificate is issued by Google Trust Services under the identifier WE1. Security vendors have flagged this domain with 18 detections out of 95 on VirusTotal, and it appears on two independent security blocklists, including PhishDestroy and PhishingDB. The page title, 'KuCoin Login: Crypto Exchange | Bitcoin Exchange | Bitcoin Trading,' precisely matches the branding of the legitimate platform, increasing the likelihood of successful deception. Current status indicates the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations and individuals are advised to monitor for unauthorized access attempts on KuCoin accounts and implement multi-factor authentication to mitigate credential theft risks. Network defenders should update blocklists with the domain and associated IP address, while users should verify the authenticity of any cryptocurrency exchange portal before entering login credentials. Historical analysis of this domain underscores the persistent threat of brand impersonation in the cryptocurrency sector, necessitating heightened vigilance.