kurcoinlagany[.]webflow[.]io

This domain, kurcoinlagany.webflow.io, is confirmed to operate as a credential theft site impersonating the KuCoin cryptocurrency exchange platform. The site presents a fraudulent login interface titled 'Kucoin *Login: Accessing Your Kucoin Account,' designed to harvest user credentials, including usernames, passwords, and potentially two-factor authentication codes. Such infrastructure is commonly used to facilitate unauthorized account access, leading to asset theft or further exploitation through crypto drainer attacks on compromised wallets. Analysis of the domain reveals multiple technical indicators supporting its malicious classification. The site was registered through Webflow and resolved to IP address 172.64.151.8, hosted on Cloudflare infrastructure (AS13335) in the United States. At the time of assessment, it appeared on one security blocklist and was flagged by 17 out of 95 security vendors on VirusTotal. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as fraudulent sites frequently use valid certificates to appear legitimate. Users who visited kurcoinlagany.webflow.io or entered credentials on the site should immediately revoke active sessions on the legitimate KuCoin platform. Affected individuals must change their passwords and enable multi-factor authentication if not already active. Wallet addresses associated with the account should be monitored for unauthorized transactions, and any linked devices or applications should be reviewed for signs of compromise. Given the elevated risk of credential reuse, users are advised to audit other accounts sharing the same login details.