access--kucoinhelp-view-cdn-x[.]webflow[.]io

Analysis indicates that the domain access--kucoinhelp-view-cdn-x.webflow.io is actively hosting a brand‑impersonation page targeting KuCoin users. The site was registered on June 12 2026 through Webflow and immediately resolved to the Cloudflare IP 104.18.36.248, located in the United States (AS13335). The TLS certificate is issued by Google Trust Services (WE1) and the HTTP response returns status 200. Detected technologies include Webflow, jQuery, Cloudflare and HTTP/3, consistent with a typical fraudulent landing page hosted on a shared SaaS platform. VirusTotal reports that 16 of 91 scanned security vendors flag the domain, and it appears on at least one public blocklist; PhishDestroy has already listed it as blocked. The page title “KuCoin: Sign‑in | Access Your Crypto Portfolio*” explicitly references the target brand, confirming a brand‑impersonation intent. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. While the exact phishing kit or credential‑harvesting mechanism has not been disclosed, the combination of a recent registration, high‑risk classification, and multiple vendor detections suggests a high likelihood of credential theft. Defenders should block the domain at the DNS and proxy layers, monitor for outbound connections to the associated IP, and alert users that any login request originating from this URL is fraudulent. Ongoing observation is recommended to capture any changes in hosting or content.