login-kucoinin[.]webflow[.]io

Analysis of login-kucoinin.webflow.io shows a newly registered Webflow‑hosted site created on 15 February 2026 that masquerades as a KuCoin login guide. The page title "ꝄuCoin® ℓoℊin - A Step‑te‑p Guide to Access Your Account" explicitly references the KuCoin brand, confirming a brand‑impersonation intent. The site serves over HTTPS with a Google Trust Services certificate issued by WE1, and traffic is routed through Cloudflare (IP 104.18.36.248, located in Canada). Detected technologies include Webflow, Cloudflare and HTTP/3, consistent with the hosting details. Reputation services assign extremely low trust scores (Scamadviser 1/100, Gridinsoft 0/100). VirusTotal scans report 17 of 91 security vendors flagging the domain, and it appears on a single public blocklist; PhishDestroy already blocks it. No additional technical artifacts such as malicious scripts or credential‑stealing forms have been publicly disclosed, so the precise payload remains uncertain. Defenders should add the domain to network and DNS blocklists, monitor for similar Webflow‑based impersonation patterns targeting crypto exchanges, and educate users that legitimate KuCoin communications never use a webflow.io subdomain. Continuous re‑evaluation is advised in case the site evolves to host active credential‑harvesting capabilities.