kuqcoienlogin[.]webflow[.]io

The domain kuqcoienlogin.webflow.io was registered on February 22, 2026 through NameCheap, Inc. and is hosted on Cloudflare infrastructure (ASN 13335) with the resolved address 172.64.151.8 located in the United States. The site served a page titled "KuCoin Login | Access Your Account Easily," indicating a direct attempt to impersonate the cryptocurrency exchange KuCoin. The page returned an HTTP 404 status at the time of analysis, and the domain has since been taken offline. Security tooling identified the site as a crypto‑related scam; sixteen of ninety‑five VirusTotal scanners flagged the domain, and it appears on a single external blocklist.

PhishDestroy also listed the domain as blocked. The site employed Webflow, Cloudflare, and HTTP/3 technologies, and the TLS certificate was issued by Google Trust Services under the "WE1" profile, confirming a valid HTTPS endpoint despite the malicious intent. Gridinsoft assigned a trust score of zero out of one hundred, reflecting a high confidence in its malicious nature.

The available evidence confirms brand impersonation targeting KuCoin users, but no additional payload, credential‑harvesting forms, or redirect behavior have been observed beyond the page title. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for similarly structured subdomains using the "kuqcoienlogin" prefix, and update detection signatures to incorporate the observed TLS certificate chain and Cloudflare IP range. Ongoing surveillance of NameCheap‑registered domains that resolve to Cloudflare IPs and reference KuCoin in page titles is recommended to pre‑empt future impersonation attempts.