qucoinlog-in[.]webflow[.]io

This domain, qucoinlog-in.webflow.io, poses a direct threat as a brand impersonation site targeting KuCoin users. Analysis indicates the page mimics the legitimate KuCoin login interface, presenting an identical page title, 'KuCoin: Log In | Sign In,' to deceive victims into submitting credentials. The objective is credential theft, likely followed by unauthorized account access or crypto asset theft. The domain infrastructure and visual design are engineered to exploit trust in the KuCoin brand, increasing the likelihood of successful compromise for users who fail to verify the URL or SSL certificate issuer. Evidence supporting the malicious classification includes detection by 19 out of 95 security vendors on VirusTotal, placement on one security blocklist, and registration through NameCheap, Inc. on February 21, 2026. The domain resolves to IP address 172.64.151.8, hosted on Cloudflare infrastructure (AS13335) in the United States. The SSL certificate, issued by Google Trust Services (WE1), further obscures the fraudulent nature by appearing legitimate at first glance. The domain was subsequently taken offline, but its prior activity and rapid deployment suggest a coordinated effort to exploit unsuspecting users. Users who visited qucoinlog-in.webflow.io or entered credentials on the site should immediately revoke active sessions on the legitimate KuCoin platform. Reset all account passwords using a secure, unique passphrase and enable multi-factor authentication (MFA) if not already active. Monitor the KuCoin account for unauthorized transactions or configuration changes, such as altered withdrawal addresses or API keys. Report the incident to KuCoin support for further investigation and potential account recovery measures. Avoid interacting with any communications, emails, or links associated with this domain, as follow-up phishing attempts may occur.