kukucoin-sso-web-logon[.]webflow[.]io

This domain, kukucoin-sso-web-logon.webflow.io, represents a targeted brand impersonation threat designed to mimic KuCoin’s single sign-on (SSO) authentication portal. Attackers leverage such domains to harvest user credentials, session tokens, or install malware under the guise of legitimate login workflows. The domain’s infrastructure and naming convention—specifically the inclusion of 'sso-web-logon'—strongly suggest an intent to deceive users into entering sensitive account details on a fraudulent platform, which could lead to unauthorized access or financial theft. Analysis indicates the domain is flagged by 17 out of 95 security vendors on VirusTotal, confirming its malicious classification. Registered through NameCheap, Inc. on February 21, 2026, the domain resolves to the IPv6 address 2606:4700:440c::ac40:9708, hosted on Cloudflare’s network (AS13335). The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the threat, as encrypted connections are commonly exploited in phishing campaigns. The domain appears on at least one security blocklist and was previously blocked by automated threat detection systems. Users who visited kukucoin-sso-web-logon.webflow.io should immediately revoke any active sessions associated with KuCoin or related services. Credentials entered on the site must be considered compromised and changed across all platforms where identical or similar passwords were used. Monitoring for unauthorized transactions or account modifications is recommended. If financial or personal data was submitted, affected individuals should report the incident to relevant authorities and enable multi-factor authentication on all critical accounts to mitigate further risk.