kuikoinslogon[.]webflow[.]io

PhishDestroy identifies kuikoinslogon.webflow.io as an elevated-risk fake login phishing domain currently active in the wild. The page impersonates KuCoin’s authentication portal, aiming to harvest user credentials and session tokens through a spoofed login interface hosted on a compromised or attacker-controlled subdomain of webflow.io. Users who enter credentials risk immediate account takeover and potential financial loss if the same login is reused across exchanges or custodial services.

This domain was flagged by 17 out of 95 VirusTotal security vendors, resolving to IP 172.64.151.8, a Cloudflare IP in the 172.64.0.0/16 range frequently associated with phishing infrastructure. The SSL certificate is issued by Google Trust Services, leveraging legitimate issuance to evade browser warnings. The webflow.io subdomain naming convention (“kuikoinslogon”) mirrors official exchange branding, increasing the likelihood of user deception.

To mitigate exposure, users should avoid clicking links to kuikoinslogon.webflow.io and instead access KuCoin exclusively via bookmarked official URLs or verified mobile apps. Report suspicious login pages to KuCoin’s phishing reporting portal and your organization’s security team. Enable hardware authentication and withdraw funds to cold storage where possible. Monitor accounts for unauthorized activity and reset passwords using only official channels.