login-kucooin[.]webflow[.]io

This domain, login-kucooin.webflow.io, was registered on March 22 2026 through the Webflow registrar and is hosted on Cloudflare infrastructure (IP 104.18.36.248, located in Canada). The site presents an HTTP 404 response and serves a page titled “Ku𝐂oin* Login - Guide Easy Steps to Access Your Account”, explicitly referencing the KuCoin brand and indicating a credential‑phishing campaign. VirusTotal records show that 19 of 94 security scanners flagged the domain as malicious, and it appears on a single public blocklist that has already been ingested by the PhishDestroy mitigation service.

The TLS certificate presented is issued by the “WE1” authority, consistent with Cloudflare‑provided certificates, and the site utilizes Webflow, Cloudflare and HTTP/3 technologies. Current intelligence marks the domain as offline, but the infrastructure components—particularly the Cloudflare IP address—remain active and could be repurposed for future malicious deployments. No additional evidence such as Safe Browsing or OTX identifiers is available, and the page content beyond the title has not been publicly captured.

Defenders should therefore block the fully qualified domain name and its resolving IP address at network borders, add the domain to URL filtering and email security policies, and monitor for any re‑registration or reuse of the same Cloudflare edge. Continuous re‑scanning with multi‑vendor sandbox services is recommended to capture any future changes in payload or behavior. Organizations using KuCoin services should alert users to the existence of this impersonation attempt and reinforce multi‑factor authentication to reduce credential‑theft risk.