kucinligio[.]webflow[.]io

This domain, kucinligio.webflow.io, poses a brand impersonation threat specifically targeting KuCoin, a cryptocurrency exchange platform. The site replicates the official KuCoin login interface, including the page title 'KuCoin Login : Crypto Exchange | Bitcoin Exchange | Bitcoin …', to deceive users into entering their credentials. Such impersonation attacks are designed to harvest login details, which can lead to unauthorized access to user accounts, financial theft, or further exploitation through secondary attacks like crypto drainers or malware distribution. Analysis indicates this domain was registered on May 08, 2013, though its malicious use appears recent. It resolves to the IP address 172.64.151.8, hosted on infrastructure belonging to Cloudflare, Inc. (AS13335) in the United States. The domain is registered through MarkMonitor, Inc., a registrar commonly used for both legitimate and malicious purposes. Security vendors on VirusTotal flagged this domain in 18 out of 95 scans, and it appears on at least one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), which does not mitigate the risk posed by the domain's content. Users who visited kucinligio.webflow.io or entered credentials on this site should immediately take corrective action. First, reset passwords for KuCoin and any other accounts where the same credentials may have been reused. Enable multi-factor authentication (MFA) on all critical accounts to prevent unauthorized access. Monitor financial transactions and account activity for signs of compromise, such as unauthorized logins or withdrawals. If cryptocurrency transactions were initiated from this domain, consider reporting the incident to relevant authorities and the targeted platform for potential recovery or mitigation steps. Additionally, scan the device used to access the domain for malware or unauthorized software.