kukkoiinlogin[.]webflow[.]io

The domain kukkoiinlogin.webflow.io has been identified as a brand impersonation threat targeting the cryptocurrency exchange KuCoin. No drainer kit was detected during the analysis. The threat poses an elevated risk due to its potential to deceive users into providing sensitive information.

Technical indicators reveal that the domain has been flagged by 18 out of 95 security vendors on VirusTotal. The domain is registered through NameCheap, Inc., and resolves to the IP address 104.18.36.248, which is located in the United States and associated with Cloudflare, Inc. The domain was created on February 21, 2026, and uses an SSL certificate issued by Google Trust Services / WE1. It appears on one security blocklist and is currently blocked by PhishDestroy.

The current status of the domain is offline, indicating that it has been taken down. Despite this, the threat actor's infrastructure and tactics remain a concern. Users are advised to verify the URL of the official KuCoin login page and to report any suspicious activity to their security teams. The remaining risk is low, but vigilance is recommended to prevent any residual deceptive content or redirection attempts.