kucoinmloginj[.]webflow[.]io

This domain, kucoinmloginj.webflow.io, is identified as a brand impersonation threat specifically targeting KuCoin, a cryptocurrency exchange platform. Analysis indicates the presence of a fake login page designed to harvest user credentials, aligning with observed tactics in cryptocurrency phishing campaigns. No explicit evidence of a crypto drainer kit was found, but the infrastructure supports credential theft, which could facilitate subsequent unauthorized transactions or account takeovers.

Technical indicators reveal the domain was registered on February 21, 2026, through NameCheap, Inc., an uncommonly future-dated creation timestamp that may suggest domain spoofing or a placeholder entry. The domain resolves to IP address 104.18.36.248, hosted on AS13335 (Cloudflare, Inc.) in the United States. VirusTotal reports 19 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist (PhishDestroy). The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider, which may lend superficial credibility to the phishing site. No detection by Google Safe Browsing was noted at the time of analysis.

As of the latest verification, kucoinmloginj.webflow.io has been taken offline, likely following detection and reporting. However, residual risk persists due to the potential reuse of the domain or migration of the phishing infrastructure to alternative hosts. Users who may have interacted with the site are advised to reset credentials immediately, enable multi-factor authentication, and monitor accounts for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP, while security teams are encouraged to analyze related infrastructure for patterns indicative of broader campaign activity.