secure-kucoin--login[.]webflow[.]io

The domain secure-kucoin--login.webflow.io is identified as a brand impersonation threat specifically targeting KuCoin, a cryptocurrency exchange platform. This domain is currently offline but was actively used to mimic the official KuCoin login interface to deceive users into submitting sensitive credentials. The threat type is classified as credential harvesting through phishing, with a focus on financial fraud. Analysis indicates this domain was flagged by 19 of 95 security vendors on VirusTotal, signaling broad recognition of its malicious intent. Registered through Webflow on March 03, 2026, the domain resolved to the IP address 104.18.36.248, hosted on Cloudflare’s infrastructure (AS13335). The SSL certificate was issued by Google Trust Services (WE1), a common tactic to lend false legitimacy. The page title, 'KuCoin: Log In | Sign In,' directly mirrors the authentic KuCoin login page. Additionally, the domain appears on one security blocklist, further confirming its malicious classification. As of the latest assessment, secure-kucoin--login.webflow.io has been taken offline, reducing immediate risk to users. However, the infrastructure and tactics observed suggest potential for re-emergence under similar domains. Organizations and individuals are advised to block this domain at the network level and monitor for related indicators of compromise. Users should verify the authenticity of login pages by checking the URL, enabling multi-factor authentication, and reporting suspicious domains to relevant security teams. Proactive monitoring of newly registered domains with similar naming patterns is recommended to mitigate future threats.