kuukooinlogin[.]webflow[.]io

This domain is flagged as an elevated-risk brand impersonation threat targeting KuCoin, a major cryptocurrency exchange. Analysis indicates the site was designed to deceive users into entering credentials or sensitive information under the guise of a legitimate KuCoin login or registration portal, as evidenced by the page title 'KuCoin: Sign Up | Register.' The infrastructure and content strongly suggest intent to harvest login details or facilitate unauthorized account access, a common tactic in cryptocurrency-related fraud schemes. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain kuukooinlogin.webflow.io resolves to IP address 104.18.36.248, hosted on Cloudflare’s network (AS13335) in the United States. It was registered on March 06, 2026, through MarkMonitor, Inc., a registrar frequently associated with both legitimate and malicious domains. The domain appears on at least one security blocklist and is flagged by 20 out of 95 security vendors on VirusTotal, indicating broad detection across threat intelligence platforms. The SSL certificate is issued by Google Trust Services under the WE1 root, a common but not inherently trustworthy issuer in phishing campaigns. Notably, the domain has been taken offline following detection, suggesting mitigation efforts by hosting providers or security teams. To mitigate risks associated with this brand impersonation threat, users should avoid interacting with the domain or any similar-looking URLs. Organizations should implement domain monitoring to detect typosquatting or lookalike domains targeting their brand, particularly those mimicking login or registration pages. Security teams are advised to block the domain and its resolving IP (104.18.36.248) at the network level, and to alert users to verify the authenticity of any KuCoin-related communications by accessing the official site directly. Multi-factor authentication should be enforced for all cryptocurrency exchange accounts to reduce the impact of credential theft. Additionally, monitoring for newly registered domains containing variations of 'kucoin' or similar branding can help preempt future impersonation attempts.