qwucoineliuogin[.]webflow[.]io

Analysis of the domain qwucoineliuogin.webflow.io indicates it was actively impersonating the cryptocurrency exchange KuCoin, as evidenced by the page title 'KuCoin Login - How to Access Your Account Easily' and explicit classification as a crypto scam. The domain, registered on March 3, 2026, resolved to IP address 104.18.36.248, hosted on Cloudflare's infrastructure (AS13335) in the United States. Infrastructure analysis reveals the use of Webflow as the content management platform, with Cloudflare providing CDN and security services, including HTTP/3 support. The SSL certificate was issued by Google Trust Services (WE1), a common configuration for legitimate and malicious sites alike. Detection data shows the domain was flagged by 19 of 94 security vendors on VirusTotal, though the specific detection rules or signatures are not detailed in available intelligence.

It appeared on at least one security blocklist, specifically PhishDestroy, which contributed to its elevated risk classification. Gridinsoft assigned a trust score of 0/100, further indicating malicious intent. As of July 24, 2026, the domain has been taken offline, returning an HTTP 404 status, which may suggest takedown action or voluntary removal by the operators. The combination of brand impersonation, cryptocurrency targeting, and detection by multiple security vendors provides concrete evidence of fraudulent activity.

Defenders should treat this domain as malicious and ensure it is blocked across web gateways, email filters, and endpoint protection systems. While the exact content of the phishing page is not analysed, the page title suggests it was designed to harvest KuCoin credentials. Organisations should monitor for related domains using similar naming patterns or infrastructure, particularly those leveraging Webflow and Cloudflare. No evidence links this domain to broader campaigns or threat actor groups at this time.