kucoinloginvgs[.]webflow[.]io

The domain kucoinloginvgs.webflow.io has been identified as a brand impersonation threat targeting the cryptocurrency exchange KuCoin. This domain was designed to deceive users into believing they were accessing the legitimate KuCoin login page, potentially leading to the theft of credentials and personal information.

Analysis indicates that the domain has been flagged by 17 out of 95 security vendors on VirusTotal, suggesting a moderate level of detection. The domain is registered through NameCheap, Inc. and resolves to the IP address 172.64.151.8, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network. The domain was created on February 21, 2026, and is currently not listed in the Google Safe Browsing database. However, it appears on one security blocklist, specifically PhishDestroy, which has blocked the domain. The SSL certificate for the domain is issued by Google Trust Services / WE1, which may have been used to establish a false sense of security.

The domain is currently offline, indicating that it has been taken down. Despite this, the threat remains elevated due to the potential for the domain to be reactivated or for similar domains to be registered in the future. Security teams and users should remain vigilant and ensure that any links or domains related to KuCoin are verified before being accessed. It is recommended to report any similar suspicious domains to the affected brand and relevant security authorities to mitigate the risk of future attacks.