kucoinnologo[.]webflow[.]io

This domain, kucoinnologo.webflow.io, is identified as a brand impersonation threat targeting KuCoin, a cryptocurrency exchange platform. Analysis indicates the domain hosted a fraudulent login page titled 'Kucoin Login: Accessing Your Kucoin Account - Webflow,' designed to harvest user credentials. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with credential theft campaigns targeting financial services. Infrastructure analysis reveals the domain was created on May 8, 2013, though the subdomain likely represents a more recent malicious deployment under Webflow’s hosting. It resolves to the IP address 104.18.36.248, associated with Cloudflare, Inc. (AS13335) in the United States. The domain is registered through MarkMonitor, Inc., a registrar commonly used for both legitimate and malicious purposes. VirusTotal detection shows 18 out of 95 security vendors flagging the domain, while it appears on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate is issued by Google Trust Services (WE1), a common but not exclusive indicator of legitimacy. As of the latest assessment, kucoinnologo.webflow.io has been taken offline, reducing immediate exposure risk. However, the domain’s historical registration and hosting on a widely used platform may allow threat actors to redeploy similar infrastructure. Organizations and users are advised to monitor for recurring impersonation attempts targeting KuCoin or other financial services, particularly those leveraging Webflow subdomains. Blocking the domain at the network level and alerting affected users to reset credentials are recommended mitigations.