kukonlgnty[.]webflow[.]io

This domain operates as a credential-harvesting phishing portal impersonating KuCoin, a major cryptocurrency exchange. The site presents a fraudulent login interface designed to capture user credentials, wallet addresses, and two-factor authentication codes. Analysis indicates the infrastructure is specifically engineered for cryptocurrency theft, with the page title explicitly mimicking legitimate KuCoin branding: 'KuCoin | Bitcoin Exchange Bitcoin Trading'. The threat extends beyond credential theft, as compromised accounts could lead to unauthorized fund transfers or installation of crypto-draining malware on connected devices.

Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered through NameCheap, Inc. on February 23, 2026, despite current detection patterns suggesting recent malicious deployment. VirusTotal detection shows 19 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The site resolves to IP address 104.18.36.248, hosted on Cloudflare infrastructure (AS13335), and uses a Google Trust Services SSL certificate (WE1). The combination of brand impersonation, cryptocurrency targeting, and recent malicious deployment warrants elevated risk classification.

Users who visited kukonlgnty.webflow.io should immediately revoke any active sessions on legitimate KuCoin platforms and enable new two-factor authentication credentials. All potentially exposed passwords should be changed across any platforms where identical credentials were used. Monitor all linked cryptocurrency wallets and bank accounts for unauthorized transactions, particularly focusing on the 72-hour window following potential exposure. If login credentials were entered, assume account compromise and contact KuCoin support for account recovery procedures. Consider implementing hardware-based authentication for sensitive financial accounts to prevent future credential-based attacks.