kuurqoinlagen[.]webflow[.]io

Analysis of kuurqoinlagen.webflow.io reveals a brand‑impersonation campaign targeting KuCoin users. The site’s page title, “KuCōin® % Login 💎 - Log In to My - Account,” directly mirrors the legitimate exchange’s branding, confirming the intent to lure credential submission. The domain was registered on March 5 2026 through MarkMonitor, Inc., a registrar commonly used by legitimate enterprises, which may be an attempt to lend credibility. Hosting is provided by Cloudflare, Inc. (ASN 13335) with the domain resolving to 172.64.151.8, an IP located in the United States. SSL termination is performed by Google Trust Services under the “WE1” certificate, meaning the connection appears encrypted and trustworthy to browsers.

VirusTotal has flagged the domain in 19 of 94 scanned security engines, indicating a moderate consensus of malicious behavior. The domain appears on one external blocklist and has been specifically blocked by PhishDestroy, demonstrating that at least one dedicated anti‑phishing service has taken action. An HTTP request returns a 404 status code, suggesting that the phishing page has been removed or is temporarily inaccessible, consistent with the reported “offline” status. The available evidence confirms that the operator’s primary objective is credential harvesting for KuCoin accounts, a typical crypto‑scam vector. However, the current offline state limits immediate observation of the payload or any secondary infrastructure, and no malware hashes or download links have been disclosed.

Consequently, the full scope of the campaign—such as the existence of additional hosting, command‑and‑control channels, or monetization pathways—remains uncertain. Defenders should proactively block the domain and its resolved IP at network perimeter devices and DNS filtering services. Monitoring for newly‑registered webflow.io subdomains that reference KuCoin or exhibit similar page titles is advisable.