kukoinlogun[.]webflow[.]io

The domain kukoinlogun.webflow.io has been identified as a brand impersonation threat targeting KuCoin, a cryptocurrency exchange platform. Analysis confirms the domain was designed to mimic the official KuCoin login interface, as evidenced by the page title 'KuCoin Log_in* | Sign_in.' This infrastructure was operational under the guise of legitimate user authentication, likely intended to harvest credentials or facilitate unauthorized account access. Infrastructure analysis reveals the domain resolved to the IP address 172.64.151.8, hosted under Cloudflare, Inc. in Canada. It was registered through Webflow, a platform commonly used for web development and hosting. The domain appears on at least one security blocklist, and 20 of 95 VirusTotal security vendors flagged it as malicious. No creation date is available in the current dataset, but the combination of brand impersonation, low detection thresholds, and Cloudflare hosting aligns with known phishing campaign patterns. The domain is currently offline, reducing immediate risk to users. However, threat actors may redeploy similar infrastructure under different domains or hosting providers. Organizations and individuals are advised to monitor for newly registered domains mimicking KuCoin or other cryptocurrency platforms, particularly those using Cloudflare IP ranges or third-party hosting services. Implementing DNS-based blocking for known malicious IPs and domains, along with multi-factor authentication (MFA) for cryptocurrency accounts, can mitigate credential theft risks. Security teams should also review logs for connections to 172.64.151.8 or related indicators of compromise.