kucoincmlggin[.]webflow[.]io

The domain kucoincmlggin.webflow.io is identified as a brand impersonation threat targeting KuCoin, a cryptocurrency exchange platform. Analysis indicates the domain was designed to mimic the official KuCoin login interface, likely to harvest user credentials or facilitate unauthorized account access. The page title, KuCōin® % Login - Bitcoin 💎 Crypto Exchange - us, employs Unicode characters to closely resemble the legitimate brand while evading basic detection mechanisms. The domain is currently offline, but prior activity warrants continued monitoring. Technical indicators confirm the domain's malicious nature. It was flagged by 20 of 95 security vendors on VirusTotal, with detections from multiple reputable engines. The domain was registered through MarkMonitor, Inc. on May 8, 2013, though the impersonation activity appears to be more recent. Infrastructure analysis reveals the domain resolved to IP address 172.64.151.8, hosted on Cloudflare's network (AS13335). The domain appears on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as encryption is commonly exploited in phishing campaigns to appear legitimate. Current status indicates the domain has been taken offline, reducing immediate risk to users. However, the infrastructure and registration details suggest potential for re-emergence under a similar or altered domain. Organizations and individuals are advised to block the domain and its associated IP address at the network level. Users who may have interacted with the domain should immediately reset their KuCoin credentials and enable multi-factor authentication. Security teams should monitor for domains with similar naming patterns, particularly those using Unicode characters or slight misspellings of the KuCoin brand. Proactive threat hunting for related indicators of compromise is recommended to identify any residual exposure.