kocioenlogen[.]webflow[.]io

This domain, kocioenlogen.webflow.io, poses as a KuCoin login guide to steal user credentials. Victims are tricked into entering sensitive account details, such as usernames, passwords, and two-factor authentication codes, under the guise of providing easy access to their crypto wallets. Once obtained, these credentials are typically used to drain funds or conduct unauthorized transactions, resulting in financial loss for the victim. The site employs subtle visual mimicry of the legitimate KuCoin platform, including logos and styling, to appear authentic and lower user suspicion. Analysis indicates this infrastructure is malicious, with 19 out of 95 security vendors on VirusTotal flagging the domain as harmful. The domain was registered on June 12, 2026, through Webflow, a platform often abused for hosting phishing content due to its ease of deployment and free tier availability. Additionally, the domain appears on one security blocklist and is blocked by at least one threat intelligence feed. The SSL certificate, issued by Google Trust Services, is valid and does not inherently indicate malicious activity, as attackers frequently use legitimate certificates to evade detection. If you visited kocioenlogen.webflow.io or entered any credentials on the site, immediate action is required. First, disconnect the affected device from the internet to prevent further data exfiltration. Next, change the passwords for any accounts accessed from the compromised device, prioritizing crypto wallets and email accounts linked to financial services. Enable multi-factor authentication if not already active. Monitor all accounts for unauthorized transactions and report any suspicious activity to the relevant platform. Finally, scan the device for malware using updated security tools to ensure no additional threats are present.