kucoinneilginus[.]webflow[.]io

The domain kucoinneilginus.webflow.io is identified as a brand impersonation threat targeting KuCoin, a cryptocurrency exchange platform. Analysis indicates this domain was designed to deceive users into disclosing login credentials by mimicking the official KuCoin interface. The page title, 'Kucoin & Login: Accessing Your Kucoin Account - Webflow,' directly references the targeted brand, reinforcing its fraudulent intent. Infrastructure analysis reveals the domain was registered through Webflow and is currently offline. It was flagged by 19 of 95 security vendors on VirusTotal, indicating a moderate level of detection. The domain resolved to IP address 172.64.151.8, associated with Cloudflare, Inc. (AS13335) in the United States. It appears on one security blocklist, specifically PhishDestroy, and no historical creation date is publicly available for this subdomain under Webflow’s platform. Current status confirms the domain has been taken offline, reducing immediate risk to users. However, similar impersonation attempts may persist. Recommended actions include monitoring for newly registered lookalike domains, blocking the identified IP (172.64.151.8) at the network perimeter, and educating users on verifying domain authenticity before entering credentials. Security teams should review logs for connections to this domain or IP to assess potential exposure.