kueccinlogon[.]webflow[.]io

Analysis of the domain kueccinlogon.webflow.io indicates it was actively impersonating the KuCoin cryptocurrency exchange platform, as evidenced by the page title 'KuCoin: Sign Up | Register - Sign up for KuCoin account' and the explicit branding target listed in threat intelligence. The domain, registered on March 22, 2026, through Webflow, resolved to IP 104.18.36.248, hosted on Cloudflare infrastructure in Canada. SSL certification was provided by Google Trust Services, and the site utilized HTTP/3, typical of modern web hosting but also common in phishing operations to evade detection.

At the time of assessment, the domain returned an HTTP 404 status, suggesting it has been taken offline, though it remains flagged by 18 of 94 security vendors on VirusTotal and appears on at least one security blocklist. The scam type is classified as a crypto scam, consistent with the impersonated brand. Defenders should treat this domain as a confirmed phishing resource, particularly given its association with Webflow, a platform frequently abused for rapid deployment of brand-impersonation pages.

While the current offline status limits further analysis, historical indicators—including the registration date, hosting provider, and SSL issuer—align with known patterns of short-lived phishing campaigns targeting cryptocurrency users. Network defenders are advised to block the domain and its resolving IP, monitor for related subdomains or redirects, and alert users who may have interacted with the site prior to its takedown.