kucainlugina[.]webflow[.]io

The domain kucainlugina.webflow.io is identified as a brand impersonation threat targeting KuCoin. The domain does not appear to be using any specific drainer kit, but its primary intent is to deceive users and potentially steal credentials.

Infrastructure analysis reveals that kucainlugina.webflow.io is flagged by 18 out of 95 security vendors on VirusTotal. The domain is registered through MarkMonitor, Inc., and resolves to the IP address 172.64.151.8, which is located in the United States under the AS13335 Cloudflare, Inc. network. The domain was created on May 08, 2013, and is currently listed on 2 security blocklists, including PhishDestroy and PhishingDB. The SSL certificate is issued by Google Trust Services / WE1, which may lend a false sense of security to users. The page title, 'Login @Kucoin - Accessing Your KuCōin Account* Easily,' further indicates an attempt to mimic the official KuCoin login page.

The domain is currently offline, which suggests that it has been taken down or is no longer active. Despite this, the elevated risk level remains due to the historical presence of the threat and the possibility of its reactivation. Security teams are advised to monitor for any signs of the domain coming back online and to ensure that users are educated about the risks of visiting unknown or suspicious login pages. Remaining risk includes potential reuse of the domain for similar attacks or the creation of new subdomains to continue the impersonation.