koeiqonlogunz[.]webflow[.]io

This domain, koeiqonlogunz.webflow.io, is flagged for brand impersonation targeting KuCoin, a major cryptocurrency exchange. Analysis indicates the page replicates the official KuCoin login interface, titled 'Kucoin Login: Accessing Your Kucoin Account - Webflow,' with the intent to harvest user credentials. No direct evidence of a crypto drainer kit was observed, but the site’s structure aligns with credential theft campaigns commonly deployed against financial platforms. The domain does not appear to host additional malicious payloads beyond the impersonation framework. Infrastructure analysis reveals the domain was registered through NameCheap, Inc. on February 21, 2026, an anomalous future date suggesting potential manipulation or misconfiguration. It resolves to the IP address 104.18.36.248, hosted on Cloudflare’s network (AS13335) in the United States. Detection metrics show 18 out of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1). No entries were found in Google Safe Browsing at the time of analysis, though this may reflect delayed reporting rather than benign status. The domain has since been taken offline, likely following detection and reporting. However, the infrastructure remains a residual risk, as the registrar and hosting provider could be reused for future campaigns. Users who interacted with the site are advised to rotate credentials immediately, particularly for cryptocurrency exchange accounts. Organizations should monitor for similar domains leveraging Webflow’s subdomain structure, as this tactic is frequently exploited for low-cost, disposable phishing pages. The elevated risk designation stems from the targeted brand’s high-value user base and the domain’s prior operational status.