kukcoiinzlogen[.]webflow[.]io

PhishDestroy has identified kukcoiinzlogen.webflow.io as an active brand impersonation phishing site specifically targeting Coinbase users. The domain is currently live and presents itself as a legitimate cryptocurrency platform, attempting to steal login credentials and potentially other sensitive information from unsuspecting visitors. The page title, "KuCōin® - 𝐋🅞𝒈 𝐈𝙣 - Your Gateway to a World of Digital Assets," mimics Coinbase's branding with deceptive Unicode characters to evade detection.

Technical analysis reveals that the domain was created on April 13, 2026, and is registered through Webflow, a legitimate web hosting service often abused by threat actors. It resolves to IP address 104.18.36.248, which is associated with Cloudflare. VirusTotal data shows that 21 out of 95 security vendors flag this domain as malicious, and it appears on one security blocklist. The SSL certificate is issued by Google Trust Services for the subject WE1, providing a false sense of security. The domain's registration and hosting details suggest a sophisticated attempt to appear legitimate while conducting phishing operations.

Given the elevated risk level and active status, users are strongly advised to avoid visiting or interacting with this domain. PhishDestroy recommends that organizations and individuals block access to kukcoiinzlogen.webflow.io at the network level and report it to relevant security authorities. Coinbase users should be particularly vigilant and only access the official Coinbase website directly. If any credentials have been entered on this phishing site, they should be changed immediately and two-factor authentication enabled. Continuous monitoring of related domains is advised to detect further impersonation attempts.