kukukoinlogin[.]webflow[.]io

The domain kukukoinlogin.webflow.io was registered on March 06, 2026 through MarkMonitor, Inc. It resolves to the Cloudflare address 172.64.151.8, which is associated with ASN 13335 (Cloudflare, Inc.) and located in the United States. The site returns HTTP 200 responses and presents a TLS certificate issued by Google Trust Services under the WE1 hierarchy, indicating that the attacker is leveraging a legitimate CDN and certificate authority to increase credibility.

Content analysis shows the page title “KuCōin® - Sign i𝒏 | Login”, directly mimicking the branding of the KuCōin cryptocurrency platform. The site is currently flagged by 16 of 95 security vendors on VirusTotal, and it appears on a single external blocklist. PhishDestroy has already added the domain to its blocklist, confirming that the infrastructure is being used for credential harvesting. The Gridinsoft trust score of 0 / 100 further reflects the malicious nature of the host.

While the detection footprint is modest—only one public blocklist and a 16/95 VirusTotal rating—the combination of a high‑risk classification, the use of a reputable TLS certificate, and the presence of a brand‑spoofing login page strongly suggests an active credential‑phishing campaign. The limited number of detections may be due to the recent creation date and the use of Cloudflare’s edge network, which can obscure direct host attribution and reduce early visibility.

Defenders should immediately block kukukoinlogin.webflow.io and its resolving IP address 172.64.151.8 at perimeter and DNS layers. Continuous monitoring of Cloudflare‑associated IP ranges for similar brand‑spoofing patterns is advised, as the attacker may replicate this template against other cryptocurrency services. End‑user education campaigns should highlight the specific page title and the risk of entering KuCōin credentials on unauthorised domains.