kucoiereilgie[.]webflow[.]io

This domain, kucoiereilgie.webflow.io, is identified as a brand impersonation threat specifically targeting KuCoin, a major cryptocurrency exchange. The site presents a fraudulent login portal with the page title "Kucoin® Loᘜin* - Your Gateway to a World of Digital Assets," designed to harvest user credentials. Analysis indicates no direct evidence of a crypto drainer kit, but the fake login page suggests intent to intercept sensitive account access details for subsequent unauthorized transactions or identity theft. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 19 out of 95 security vendors on VirusTotal, indicating a moderate to high level of detection. It is registered through Webflow and resolves to the IP address 104.18.36.248, associated with AS13335 (Cloudflare, Inc.) in the United States. The domain creation date is recorded as March 06, 2026, which may suggest an error in registration data or an attempt to obscure its true age. The SSL certificate is issued by Google Trust Services (WE1). The domain appears on one security blocklist and is currently blocked by PhishDestroy. As of the latest assessment, kucoiereilgie.webflow.io has been taken offline, reducing immediate risk to users. However, the infrastructure remains a potential vector for future malicious activity, particularly if the operators re-deploy the phishing kit under a different domain or hosting provider. Users who may have interacted with this site are advised to immediately reset their credentials on the legitimate KuCoin platform and enable multi-factor authentication. Organizations should monitor for similar impersonation attempts, particularly those leveraging Webflow or Cloudflare infrastructure, and update blocklists to include related indicators of compromise.