kucoinrloggen[.]webflow[.]io

This domain, kucoinrloggen.webflow.io, is flagged as a brand impersonation threat targeting KuCoin, a cryptocurrency exchange platform. Analysis indicates the site mimics KuCoin’s official login portal, likely designed to harvest user credentials and sensitive account information. The page title, 'KuCōin® % Login 💎 - Log In to My - Account,' employs Unicode manipulation (replacing 'o' with 'ō') to evade basic detection mechanisms while maintaining visual similarity to the legitimate brand. No direct evidence of a drainer kit was observed, but the site’s structure aligns with credential-phishing campaigns commonly used in cryptocurrency theft operations. Technical indicators reveal the domain was registered through Webflow, a legitimate website builder platform often abused for phishing infrastructure. It resolves to the IP address 104.18.36.248, hosted on Cloudflare’s network in Canada, a common tactic to obscure the true origin of malicious activity. VirusTotal detections show 19 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The domain’s current status is offline, though no specific creation date or Google Safe Browsing (GSB) status was provided in available intelligence. The domain has been taken offline, likely due to detection and reporting by security vendors such as PhishDestroy. However, the infrastructure remains a residual risk, as threat actors may repurpose similar domains or hosting platforms for future campaigns. Organizations and users are advised to monitor for domains using Unicode spoofing (e.g., 'KuCōin') and enforce multi-factor authentication (MFA) for cryptocurrency accounts. Network-level blocking of the IP 104.18.36.248 and domains registered via Webflow with similar patterns is recommended for proactive defense.