kyicoinalougin[.]webflow[.]io

The domain kyicoinalougin.webflow.io is flagged as a brand‑impersonation site targeting KuCoin. VirusTotal records show that 16 of 93 security vendors have flagged the domain, indicating a moderate level of detection confidence. The site presented a page title of "Kucoin Login: Accessing Your Kucoin Account - Webflow," directly referencing the KuCoin brand and reinforcing the impersonation assessment. The SSL certificate is issued by Google Trust Services under the WE1 certificate authority, which provides a valid chain but does not mitigate the malicious intent.

Infrastructure analysis reveals the domain is hosted on Cloudflare, utilizes HTTP/3, and resolves to IP 104.18.36.248, an address owned by AS13335 Cloudflare, Inc. in the United States. Nameserver records point to journey.ns.cloudflare.com and lamar.ns.cloudflare.com, confirming the Cloudflare deployment. HTTP responses return a 403 status, suggesting that the content is currently inaccessible or deliberately blocked. Registration information shows the domain was created on May 08, 2013 and is registered through MarkMonitor, Inc., a registrar commonly used by legitimate enterprises, indicating that the registration may have been repurposed for malicious activity.

The domain appears on a single security blocklist and has been actively blocked by PhishDestroy, supporting its classification as a crypto‑scam vector. Risk is elevated, and the current status is offline, limiting immediate threat exposure but leaving the potential for future re‑hosting. Defenders should add kyicoinalougin.webflow.io to URL filtering and DNS block lists, monitor the associated IP address for any resurgence of malicious content, and remain alert for other Webflow subdomains that may employ similar KuCoin branding. Ongoing verification of the domain’s status and periodic re‑scanning are recommended to capture any changes in its operational posture.