ku-coine--logiusa[.]webflow[.]io

This domain represents a credential harvesting infrastructure specifically designed to impersonate KuCoin, a major cryptocurrency exchange platform. The site mimics the official KuCoin login interface, presenting users with a fraudulent page titled 'Log In | Kucoin (Official Site)® - Sign In to Your Account™' to deceive victims into entering sensitive account credentials. Such impersonation attacks are commonly used to gain unauthorized access to cryptocurrency wallets, enabling threat actors to conduct unauthorized transactions or steal digital assets directly from compromised accounts.

Analysis of the domain ku-coine--logiusa.webflow.io reveals multiple indicators of malicious activity. The domain was registered through Webflow on April 28, 2026, and currently resolves to the IP address 104.18.36.248, hosted on Cloudflare infrastructure in Canada. Security vendors on VirusTotal flagged this domain as malicious, with 20 out of 95 engines detecting it as a threat. Additionally, the domain appears on one security blocklist and is actively blocked by at least one threat intelligence feed. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging widely trusted certificate authorities.

Users who visited ku-coine--logiusa.webflow.io or entered credentials on this portal should immediately take corrective actions. First, reset passwords for KuCoin and any other accounts where identical credentials may have been reused. Enable multi-factor authentication (MFA) on all financial and cryptocurrency-related accounts to mitigate unauthorized access. Monitor account activity for suspicious transactions, particularly any unauthorized withdrawals or transfers. If cryptocurrency was transferred to an unknown wallet, report the incident to the relevant exchange and local cybercrime authorities, providing transaction hashes and timestamps for investigation. Additionally, scan local devices for malware, as credential harvesting sites may deploy secondary payloads to maintain persistence.