kuconlgen[.]webflow[.]io

This domain, kuconlgen.webflow.io, was created on 2026-03-06 and is hosted on Cloudflare (AS13335) at IP 104.18.36.248. The site presents a TLS certificate issued by Google Trust Services under the WE1 intermediate, indicating the connection is encrypted but does not imply legitimacy. The page title returned by the server is “Ku‌Coin* Login - Guide Easy Steps to Access Your Account”, which aligns with a credential‑phishing narrative targeting users of a cryptocurrency‑related service. HTTP probing returned a 404 status, and the domain is currently offline.

Reputation data show the domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy feed. VirusTotal scans report 16 of 94 antivirus engines flagging the domain as malicious, reinforcing the phishing classification. Registration details reveal the domain was purchased through MarkMonitor, a registrar commonly used for legitimate brands, suggesting possible abuse of a reputable registrar to conceal malicious activity. The combination of a recent creation date, Cloudflare hosting, a legitimate‑looking TLS certificate, and the presence of a credential‑phishing page title indicates an opportunistic phishing campaign rather than a long‑running infrastructure.

Uncertainty remains regarding the exact payload or credential collection mechanism because the site is offline and no content was captured beyond the title. Defenders should continue to block the domain at perimeter filters, update URL‑filtering and DNS‑sinkhole rules, and monitor for any re‑appearance on the same IP or certificate. Additional verification of related subdomains and any future re‑registration attempts should be logged, and organizations should educate users about unsolicited login pages that reference “KuCoin” or similar cryptocurrency services.