kuciuinulogin[.]webflow[.]io

Analysis of kuciuinulogin.webflow.io indicates this domain was actively impersonating KuCoin, a cryptocurrency exchange, as part of a crypto scam operation. The domain, registered on March 6, 2026, through MarkMonitor, Inc., resolved to 104.18.36.248 (AS13335 Cloudflare, Inc., US) and is now offline, returning an HTTP 404 status. The page title, 'Kucoin* Login: Accessing Your Kucoin Account - Webflow,' explicitly targeted KuCoin users, suggesting an attempt to harvest login credentials. SSL certification was provided by Google Trust Services (WE1), a common feature in both legitimate and malicious sites, offering no inherent trust signal.

At the time of assessment, 19 of 94 security vendors on VirusTotal flagged the domain, and it appeared on one security blocklist (PhishDestroy). While the domain is no longer accessible, historical infrastructure analysis reveals it leveraged Cloudflare hosting, a frequent choice for phishing campaigns due to its CDN and proxy services. The use of Webflow, a legitimate website builder, aligns with observed tactics where attackers exploit free or low-cost hosting platforms to deploy phishing pages quickly. Defenders should treat this domain as confirmed malicious infrastructure.

Although offline, it may reappear under the same or similar names. Security teams are advised to block the domain at the DNS and proxy levels, monitor for related subdomains or typosquatting variants, and review logs for connections to 104.18.36.248 or the AS13335 range. If KuCoin credentials were entered on this site, affected users should be directed to rotate passwords and enable multi-factor authentication immediately. No evidence of malware distribution or additional payloads was identified in the available data, but the domain’s crypto-focused impersonation warrants heightened scrutiny for related financial fraud activity.