keucoinllogin[.]webflow[.]io

This domain, keucoinllogin.webflow.io, is assessed as an elevated-risk brand impersonation scam targeting KuCoin, a cryptocurrency exchange. Infrastructure analysis reveals the domain was created on May 8, 2013, though its use for malicious activity appears recent, as it is currently offline with an HTTP 404 status. The domain resolves to IP 104.18.36.248, hosted on Cloudflare's network (AS13335) in the United States, and employs Cloudflare nameservers (journey.ns.cloudflare.com, lamar.ns.cloudflare.com). SSL certification is provided by Google Trust Services (WE1), a common configuration for legitimate and malicious sites alike, offering no inherent indication of trustworthiness. The page title, 'Kucoin login| Crypto Exchange | Bitcoin Exchange | Bitcoin Trading,' directly references KuCoin's branding and core services, confirming the intent to impersonate the exchange.

The domain is flagged by 13 of 95 security vendors on VirusTotal, a detection rate consistent with confirmed phishing or scam infrastructure. It appears on at least one security blocklist and is actively blocked by PhishDestroy, further supporting its classification as malicious. The scam type is explicitly labeled as a 'Crypto Scam,' aligning with the targeted brand and page content. Defenders should note that the domain is registered through MarkMonitor, Inc., a registrar commonly used for both legitimate and fraudulent domains, offering no clear signal of legitimacy. The use of Cloudflare and HTTP/3 is typical for modern phishing sites, as these technologies provide performance and evasion benefits.

While the domain is currently offline, historical or cached versions may still pose a risk if accessed via search engines, archives, or malicious redirects. No concrete evidence links this domain to a specific phishing kit or campaign, and the exact content of the site remains unanalyzed.