kukonlgon[.]webflow[.]io

This domain, kukonlgon.webflow.io, is identified as a credential-harvesting phishing site targeting KuCoin users. The page mimics the official KuCoin login interface, presenting itself with the title 'KuCoin Login | How to Access Your Account Easily.' As of the latest analysis, the domain is offline, but prior activity indicates an elevated risk of brand impersonation and credential theft. Analysis indicates the domain was flagged by 18 of 95 security vendors on VirusTotal, suggesting widespread detection as malicious. It was registered through NameCheap, Inc. on February 21, 2026, and resolved to the IP address 172.64.151.8, hosted on Cloudflare infrastructure (AS13335). The domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1). Infrastructure analysis reveals the use of Content Delivery Network (CDN) services, a common tactic to obscure hosting origins and evade takedowns. The domain is currently offline, but historical indicators confirm its malicious intent. Organizations and users are advised to block the domain and IP address in network security controls. Security teams should monitor for related domains registered through the same registrar or resolving to the same IP range. Users who may have interacted with this domain should reset credentials immediately and enable multi-factor authentication on all financial accounts. Proactive threat hunting for similar impersonation domains targeting cryptocurrency platforms is recommended.