qucoinnlog-in[.]webflow[.]io

The domain qucoinnlog-in.webflow.io has been identified as a credential phishing site specifically targeting users of the KuCoin cryptocurrency exchange platform. Analysis confirms this domain was designed to impersonate the legitimate KuCoin login interface, as evidenced by its page title, 'KuCoin: Log In | Sign In,' and its focus on harvesting user credentials. The site is currently offline, though prior activity indicates an elevated risk to users who may have interacted with it during its operational period. Infrastructure analysis reveals multiple indicators of malicious intent. The domain was flagged by 17 of 95 security vendors on VirusTotal, a notable detection rate that underscores its classification as a phishing threat. Registered through NameCheap, Inc. on February 21, 2026, the domain resolves to the IP address 104.18.36.248, hosted on Cloudflare's network (AS13335). It appears on one security blocklist, further confirming its malicious status. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the domain's fraudulent nature, as phishing sites frequently employ valid certificates to appear legitimate. At present, the domain has been taken offline, reducing immediate risk to users. However, organizations and individuals should remain vigilant, as similar domains may emerge. It is recommended to monitor for any residual redirects or cached versions of the site. Users who may have entered credentials on this domain should immediately reset their KuCoin passwords and enable multi-factor authentication. Network administrators are advised to block the domain and its associated IP address (104.18.36.248) at the firewall level to prevent potential future access attempts.