kucoeneloginrow[.]webflow[.]io

PhishDestroy identifies kucoeneloginrow.webflow.io as an active credential phishing domain impersonating the cryptocurrency exchange KuCoin. The domain is currently live and operational, designed to deceive users into submitting login credentials under false pretenses. This campaign poses an elevated risk to exposed users, particularly those with existing cryptocurrency holdings or trading accounts, due to the immediate potential for financial loss upon credential submission.

This domain was flagged by 18 of 95 VirusTotal security vendors, indicating a moderate but significant detection rate. It resolves to IP address 172.64.151.8 and utilizes an SSL certificate issued by Google Trust Services, which may enhance its credibility to unsuspecting victims. The domain is hosted on Webflow’s platform and was created recently, with no available data on registrar or blocklist inclusion at this time. The combination of a legitimate hosting provider and valid SSL certificate increases the likelihood of successful user deception, especially when combined with branding mimicking a well-known cryptocurrency platform.

The current status of kucoeneloginrow.webflow.io remains active as of the latest intelligence. Given the elevated risk and the specific targeting of financial credentials, immediate action is required. Organizations and users are advised to block the domain at the network perimeter and DNS level. Users who may have interacted with this domain should assume credential compromise and initiate password resets, enable multi-factor authentication, and monitor accounts for unauthorized activity. Security teams should scan endpoints for signs of credential harvesting or follow-on compromise. This domain should be treated as a high-confidence indicator of compromise and distributed across threat intelligence platforms to prevent further exposure.