kukinlougyen[.]webflow[.]io

This domain is flagged for elevated-risk brand impersonation targeting KuCoin, a major cryptocurrency exchange. Analysis indicates the site operates as a fraudulent login portal, designed to harvest credentials and facilitate unauthorized account access. The page title, 'KuCoin Login: How to Access Your Account Easily,' explicitly mimics legitimate KuCoin authentication pages, increasing the likelihood of successful deception among users seeking account access. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain is detected by 19 out of 95 security vendors on VirusTotal, with registration handled through MarkMonitor, Inc. It resolves to IP address 172.64.151.8, hosted on Cloudflare’s network (AS13335) in the United States. The domain was created on March 06, 2026, an anomalous future date suggesting potential falsification or misconfiguration. It appears on one security blocklist and is currently offline, having been blocked by automated phishing mitigation systems. The SSL certificate, issued by Google Trust Services (WE1), provides a superficial layer of legitimacy but does not mitigate the underlying fraudulent intent. Mitigation against this threat requires immediate action from both users and security teams. Users who may have interacted with the domain should revoke any active sessions, reset credentials via the official KuCoin platform, and enable multi-factor authentication. Security teams should add the domain and associated IP (172.64.151.8) to internal blocklists, monitor for credential reuse across other platforms, and alert affected users. Given the use of Cloudflare infrastructure, further investigation into related subdomains or IP ranges may uncover additional fraudulent endpoints. Organizations should also review registrar logs for similar impersonation attempts registered through MarkMonitor.