kocuinloginiu[.]webflow[.]io

Analysis of the domain kocuinloginiu.webflow.io indicates a confirmed brand impersonation targeting KuCoin, a cryptocurrency exchange. The domain, registered on March 3, 2026, through Webflow, was flagged by 18 of 94 security vendors on VirusTotal, reflecting elevated detection consensus. It appears on at least one security blocklist, including PhishDestroy, and holds a Gridinsoft trust score of 0/100, further corroborating its malicious classification. The page title, 'Expert KuCoin Login Assistance | Get the Support You Need,' explicitly aligns with the reported scam type of a crypto scam, designed to deceive users seeking login support for KuCoin.

Infrastructure analysis reveals the domain resolves to IP address 172.64.151.8, hosted on Cloudflare's network (AS13335) in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common practice among both legitimate and malicious sites leveraging Cloudflare's services. The domain is currently offline, returning an HTTP 404 status, which may indicate takedown efforts or temporary suspension by the hosting provider. Technologies detected include Webflow, Cloudflare, and HTTP/3, consistent with modern web hosting environments that can be exploited for phishing campaigns.

While the domain's content has not been directly analyzed, the combination of its page title, detection by multiple security vendors, and its presence on blocklists provides concrete evidence of its intent to impersonate KuCoin. Defenders should treat this domain as malicious and prioritize blocking or monitoring any residual DNS resolutions. Given its offline status, further investigation may be limited, but historical WHOIS data and SSL certificate details could yield additional indicators for retrospective threat hunting. Organizations are advised to review logs for connections to 172.64.151.8 or related subdomains and alert users who may have interacted with the site prior to its takedown.