kucoinuylogin[.]webflow[.]io

This domain, kucoinuylogin.webflow.io, is actively impersonating KuCoin as of July 12, 2026, and is classified as a high-risk credential-phishing site. The page title, 'Get Started with KuCoin Login: Your Gateway to Crypto Trading,' explicitly targets users of the KuCoin cryptocurrency exchange. Infrastructure analysis reveals the domain is hosted on Webflow and resolves to 172.64.151.8, an IP address associated with Cloudflare in Canada. The site uses Cloudflare services and HTTP/3, which may complicate detection or takedown efforts due to the use of modern web protocols and proxy services. The domain appears on at least one security blocklist and is flagged by 19 of 91 security vendors in a recent scan, indicating broad recognition as malicious. The Gridinsoft trust score of 0/100 further supports its classification as a phishing site. No nameservers are currently associated with the domain, which may suggest recent deactivation or evasion tactics. The SSL certificate, issued by Google Trust Services, does not provide additional trust, as phishing domains commonly use valid certificates to appear legitimate. Defenders should treat this domain as an active threat targeting KuCoin users. Immediate actions include blocking the domain and its resolving IP at the network level, alerting users to the phishing campaign, and monitoring for credential submissions or related fraudulent activity. Given the use of Cloudflare and Webflow, traditional takedown requests may require coordination with both hosting and proxy providers. No further details about the phishing kit or backend infrastructure are currently available, so additional analysis of network traffic or captured samples may be necessary to identify attack patterns or linked campaigns.