kucyinkcin[.]webflow[.]io

This domain, kucyinkcin.webflow.io, is flagged as a brand impersonation threat targeting KuCoin, a cryptocurrency exchange. Analysis indicates the site replicates KuCoin’s login interface, as evidenced by the page title "Kucoin Login: Accessing Your Kucoin Account - Webflow," designed to harvest user credentials. No drainer kit signatures were detected in initial scans, but the domain’s structure and content align with credential phishing campaigns commonly deployed against financial platforms. Infrastructure analysis reveals the domain resolves to 172.64.151.8, an IP address associated with Cloudflare, Inc. (AS13335) in the United States. The domain was originally created on May 08, 2013, though the subdomain’s malicious use appears recent. It is registered through MarkMonitor, Inc., and holds an SSL certificate issued by Google Trust Services (WE1). The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is flagged by 17 out of 95 security vendors on VirusTotal. Google Safe Browsing status was not explicitly provided but is presumed active given the blocklist presence. The domain is currently offline, mitigating immediate user exposure. However, residual risk persists due to the potential for infrastructure reuse or re-registration under altered subdomains. Organizations should monitor for related indicators, including the IP address 172.64.151.8 and the SSL certificate issuer. Users are advised to verify domain authenticity before entering credentials, particularly on platforms hosting financial services. Security teams should update blocklists to include this domain and its associated indicators to prevent future access attempts.