kuucoindlogin[.]webflow[.]io

This domain, kuucoindlogin.webflow.io, is a confirmed credential harvesting site targeting users of the KuCoin cryptocurrency exchange. Analysis indicates the page employs Unicode homoglyph substitution in its title, "KuCȍin Lȍgin: How to Access Your Account Easily," to mimic the legitimate KuCoin login portal. The use of non-ASCII characters (U+024D and U+024D) in place of standard Latin letters is a deliberate tactic to bypass basic security filters and deceive users into entering sensitive account credentials. The domain’s infrastructure is designed to capture usernames, passwords, and potentially two-factor authentication codes, which are then exfiltrated to attacker-controlled servers for unauthorized account access or financial theft. Evidence supporting this assessment includes detection by 9 of 95 security vendors on VirusTotal, with the domain appearing on at least one public blocklist. The site was hosted on Webflow’s platform and resolved to the IP address 172.64.151.8, a Cloudflare-assigned address commonly used for both legitimate and malicious content distribution. The SSL certificate, issued by Google Trust Services, provides a false sense of security, as encryption does not validate the legitimacy of the site. No creation date is available, but the domain’s recent takedown suggests it was operational for a short period, likely during a targeted phishing campaign. Users who visited kuucoindlogin.webflow.io or entered credentials on the site should immediately take corrective action. First, change the password for their KuCoin account and any other platforms where the same credentials were reused. Enable multi-factor authentication (MFA) using an authenticator app or hardware key, avoiding SMS-based methods due to susceptibility to SIM-swapping attacks. Monitor the KuCoin account for unauthorized transactions, and report any suspicious activity to the exchange’s support team. Additionally, scan the device used to access the site for malware, as phishing pages may deploy malicious scripts or redirect to exploit kits. If financial loss is suspected, contact the relevant financial institution and file a report with local cybercrime authorities.