kucoinbh[.]webflow[.]io

This domain is flagged as an elevated-risk brand impersonation threat targeting KuCoin, a major cryptocurrency exchange. Analysis indicates the site was designed to deceive users into submitting login credentials, likely for account takeover or subsequent crypto asset theft. The use of Unicode characters in the page title (KuCoin 𝐋🅞𝒈 𝐈𝙉: BTC, Crypto Exchange) suggests an attempt to evade basic text-based detection while maintaining visual legitimacy for victims. Infrastructure analysis reveals the domain kucoinbh.webflow.io was registered through Webflow, a legitimate website builder often abused for rapid phishing deployment. The domain resolved to IP 104.18.36.248, hosted on Cloudflare's network (AS13335), a common tactic to obscure origin and leverage SSL encryption. The creation date is listed as March 03, 2026, which may indicate a typo-squatting attempt or incorrect registry data. At the time of assessment, 19 out of 95 security vendors on VirusTotal flagged the domain, and it appeared on one security blocklist. The SSL certificate was issued by Google Trust Services (WE1), providing a false sense of security to potential victims. Mitigation requires immediate action from both users and security teams. Organizations should block the domain and associated IP at the network level, while monitoring for internal access attempts. Users who may have interacted with the site should reset KuCoin credentials from a clean device and enable multi-factor authentication. Security teams should search logs for connections to 104.18.36.248 or DNS queries for kucoinbh.webflow.io, particularly from endpoints handling cryptocurrency transactions. Given the offline status, this domain may reappear under a new subdomain or similar Webflow-hosted URL, necessitating proactive monitoring of Webflow's *.webflow.io namespace for additional KuCoin impersonation attempts.