kucabnlogi[.]webflow[.]io

This domain, kucabnlogi.webflow.io, operates as a fraudulent cryptocurrency login portal designed to harvest user credentials. The site impersonates KuCoin, a legitimate cryptocurrency exchange, by replicating its branding, login interface, and account access workflows. Victims who enter their credentials risk immediate account takeover, unauthorized fund transfers, and potential loss of digital assets. The page title, 'ꝄuCoin® ℓoℊin@% A Step-by-tep Guide to Access Your Account,' includes typographical distortions and special characters to evade basic detection while maintaining visual similarity to the authentic platform. Infrastructure analysis reveals the site was hosted on Cloudflare IP 104.18.36.248, a common tactic to conceal origin servers and leverage SSL encryption for perceived legitimacy. Analysis confirms the domain was registered through MarkMonitor, Inc. on March 08, 2026, though the creation date appears manipulated or incorrectly recorded, as it postdates the current year. The domain resolves to a Cloudflare IP address within autonomous system AS13335, a pattern frequently observed in phishing campaigns due to Cloudflare’s free SSL certificates and IP masking capabilities. Security vendors on VirusTotal flagged the domain with 20 detections out of 95, indicating moderate to high confidence in its malicious nature. The site was listed on at least one security blocklist and subsequently taken offline, though similar domains may remain active or re-emerge under different names. Users who visited kucabnlogi.webflow.io and entered credentials should assume their account information has been compromised. Immediate action is required: change passwords on the legitimate KuCoin platform and any other services where the same credentials were reused. Enable multi-factor authentication using an authenticator app or hardware key, not SMS. Monitor account activity for unauthorized transactions and report suspicious logins to the exchange’s security team. If cryptocurrency was transferred, document transaction hashes and file a report with relevant blockchain analysis services and local cybercrime authorities. Avoid interacting with any further communications from the domain or related email addresses, as attackers may attempt follow-up phishing attempts via email or messaging platforms.