kukinlugon[.]webflow[.]io

PhishDestroy identifies kukinlugon.webflow.io as a high-risk cryptocurrency phishing site designed to steal login credentials for KuCōin users. The fraudulent page displays a convincing replica of the legitimate KuCōin exchange sign-in interface, using Unicode manipulation in the title (KuCōin® - 𝑺î𝗴𝒏 i𝒏 - 𝐋 o𝒈 𝐈𝙣) to appear authentic while evading basic detection. When visitors enter their username and password, the credentials are immediately harvested by attackers who then gain access to real KuCōin accounts to steal funds or perform unauthorized transactions. This domain was flagged by 21 out of 95 VirusTotal security vendors, with detection beginning immediately upon activation. The site resolves to IP address 172.64.151.8 and was created recently, leveraging the legitimate Webflow.io hosting platform to lend false credibility to the scam. The domain remains active despite being blocked by OpenPhish and appearing on one security blocklist. Notably, the site uses a Google Trust Services SSL certificate to create a false sense of security, though this does not indicate legitimacy. The combination of recent creation, low blocklist coverage, and partial detection suggests this campaign is actively evolving to evade defenses. If you visited kukinlugon.webflow.io, immediately change your KuCōin password using a different device or network to prevent credential stuffing attacks. Enable two-factor authentication on your KuCōin account and check for any unauthorized transactions. Consider revoking any API keys or connected applications. Report the incident to KuCōin support and monitor your email for phishing attempts using the same credentials. Use a password manager to prevent reuse of compromised credentials across other platforms. If you entered payment details, contact your bank immediately to report potential fraud.