kucoiniellogin[.]webflow[.]io

PhishDestroy identifies kucoiniellogin.webflow.io as a recently active domain designed to impersonate the legitimate KuCoin cryptocurrency exchange. This site mimics KuCoin’s branding and login interface to trick users into disclosing their credentials or other sensitive information. The threat actor leverages the trusted Webflow.io subdomain to appear legitimate while hosting a fraudulent login page that closely resembles KuCoin’s official portal. This approach lowers user suspicion and increases the likelihood of successful credential harvesting. This domain was flagged by PhishDestroy’s automated pipeline using seed 4f2d6b. Technical analysis reveals that kucoiniellogin.webflow.io resolves to IP 172.64.151.8 and is currently undetected by VirusTotal with 20 out of 95 engines flagging it as malicious. The site uses a Google Trust Services SSL certificate to further enhance credibility. Notably, the domain is hosted on Webflow’s infrastructure — a legitimate platform often abused by threat actors to deploy convincing phishing pages due to its reputation and ease of use. Creation date and registrar details are not publicly disclosed via WHOIS, which is common for newly registered domains used in impersonation campaigns. It remains unblocked by major threat intelligence feeds at this time, indicating active evasion tactics. If you have visited kucoiniellogin.webflow.io or entered any information, immediately change your KuCoin account password using the official website (kucoin.com) and enable two-factor authentication. Review your account activity for unauthorized transactions and revoke any API keys or third-party integrations you did not authorize. Contact KuCoin support through verified channels if you suspect compromise. Use a password manager to avoid manually typing credentials on unfamiliar sites. Always verify domains by checking for HTTPS, correct spelling, and official branding — especially when accessing financial platforms. Stay vigilant and report suspicious domains to PhishDestroy for further analysis.