kucoinlogn[.]webflow[.]io

The domain kucoinlogn.webflow.io is currently flagged as an active brand_impersonation threat targeting KuCoin, a cryptocurrency exchange platform. Analysis indicates the domain hosts a fraudulent login portal mimicking the legitimate KuCoin authentication interface, designed to harvest user credentials and sensitive financial information. The page title, 'Kucoin Login | Crypto Exchange | Bitcoin Exchange,' directly replicates the branding and terminology used by the authentic KuCoin service, increasing the likelihood of successful deception. Infrastructure analysis reveals the domain was registered through MarkMonitor Inc. on May 8, 2013, though the malicious subdomain under webflow.io suggests recent abuse of a legitimate hosting service. The domain resolves to the IP address 172.64.151.8 and is protected by Cloudflare, utilizing HTTP/3 for content delivery. The SSL certificate is issued by Google Trust Services, which may lend an appearance of legitimacy to unsuspecting users. Detection metrics indicate the domain is flagged by 18 of 95 security vendors on VirusTotal and appears on one security blocklist, including PhishDestroy. The combination of brand impersonation, low detection coverage, and use of reputable infrastructure providers contributes to the elevated risk profile of this threat. Current status remains active, with no evidence of takedown or remediation at the time of analysis. Organizations and users are advised to block the domain and associated IP address at the network perimeter. Security teams should monitor for credential theft attempts originating from this domain and conduct internal audits for any successful compromises. End users should be educated on verifying domain authenticity before entering login credentials, particularly for financial platforms. Additional scrutiny is recommended for any subdomains under webflow.io exhibiting similar impersonation patterns, as this hosting service may be exploited for further phishing campaigns.