sso-en-kuccoin[.]webflow[.]io

The domain sso-en-kuccoin.webflow.io was registered on March 03, 2026 through the Webflow platform. It resolves to the IP address 172.64.151.8, which is owned by Cloudflare, Inc. and geolocated to Canada. The site is served over HTTPS using a certificate issued by Google Trust Services (WE1) and supports HTTP/3, indicating a modern web stack. The underlying infrastructure consists of Webflow‑hosted pages behind Cloudflare’s reverse‑proxy network, a pattern commonly abused for credential‑harvesting sites.

Threat intelligence shows the domain is actively flagged by multiple security engines. VirusTotal reports 17 out of 95 scanners labeling the domain as malicious, and the Gridinsoft trust score is 0 out of 100. The URL appears on the PhishDestroy blocklist and one additional public blocklist. The site returns HTTP 200 for the landing page, and the page title reads “KuCoin: Log In | Sign In”, directly mimicking the official KuCoin login portal.

The content is designed to impersonate the cryptocurrency exchange KuCoin, a classic brand‑impersonation technique used to harvest user credentials and private keys. The page title and visual cues aim to convince victims that they are accessing a legitimate KuCoin login, while the underlying URL remains a Webflow subdomain. No evidence of additional hosting, command‑and‑control infrastructure, or malware payloads has been observed beyond the phishing front‑end.

Defenders should block the domain at network perimeter and add it to local blacklists. Email filtering rules that detect the “KuCoin: Log In | Sign In” title or the Webflow subdomain pattern can reduce exposure. Users should be educated to verify the authentic KuCoin domain (kucoin.com) and to avoid entering credentials on any site that does not match the official TLS certificate fingerprint. Continuous monitoring of Cloudflare‑hosted subdomains for new KuCoin‑related impersonations is recommended.