kucoinnlogina[.]webflow[.]io

The domain kucoinnlogina.webflow.io was registered on March 19, 2026 and is currently hosting a counterfeit login page that mimics the official KuCoin cryptocurrency exchange. The page title “Kucoin Login | Bitcoin Exchange | Bitcoin Trading | KUCOIN” directly copies the branding of the target, indicating a brand‑impersonation campaign aimed at harvesting user credentials. Technical analysis shows the site is served via Webflow’s hosting platform and protected behind Cloudflare’s edge network, using HTTP/3. The resolved address 104.18.36.248 belongs to Cloudflare, Inc. in Canada, confirming the use of a reputable CDN rather than a dedicated malicious server. The SSL certificate presented is identified as “WE1”, which is typical for Webflow‑issued certificates. Security scanners have assigned a high risk rating: VirusTotal reports 18 of 95 vendors flagging the domain as malicious, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on a single external blocklist and has already been taken down by PhishDestroy. The HTTP response code is 200, indicating the page loads successfully, and the content is delivered over a valid TLS connection. While the hosting infrastructure is legitimate, the malicious intent is evident from the cloned brand elements and the cryptocurrency‑focused page title. Defenders should block the domain at network perimeter and update URL filtering policies to include kucoinnlogina.webflow.io. Incident responders should monitor for credential‑theft attempts targeting KuCoin users and educate end‑users about the fraudulent login page. Continuous observation of related Webflow‑hosted subdomains is advised, as the attacker may reuse the same infrastructure for additional impersonation attempts.