SafeMode - Analysis: kucinsh-lgin.webflow.io

Visual Capture

Detection Info

https://kucinsh-lgin.webflow.io/

Detected Brand

KuCoin

Country

International

Confidence

100%

HTTP Status

200

Report ID

11200e16-03a…

Analyzed

2026-03-12 09:07

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T163E1E82FC20806111B218569BEB513CDE39F044CF3614AEA2EB8D07D72BA7914E3769F
CONTENT ssdeep	192:gbnTPJT8bQstE8R+29SP/TRgz9ikUoTf+ZEVaey4:gbn7JT8bQstE8M29SY+YmKaey4

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	bdd29268c26c3e93
VISUAL aHash	ffffbfffff81817f
VISUAL dHash	ac3b3b631b2b33e0
VISUAL wHash	fe0b0999fb81811f
VISUAL colorHash	07200000600
VISUAL cropResistant	ac3b3b631b2b33e0,139dcdcf98adad54,a9acd69ce28e2c8c,69ac9c8c9a4cd819,a0a78eae8c8c9a15

Code Analysis

Risk Score 73/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Personal Info

🔬 Threat Analysis Report

• Threat: Phishing
• Target: KuCoin users
• Method: Impersonation via free hosting
• Exfil: Likely steals login credentials. Obfuscation suggests attempts to hide data exfiltration.
• Indicators: Free hosting, brand logo, 'Sign In' link, form obfuscation detected. Forms detected.
• Risk: High

🔒 Obfuscation Detected

fromCharCode

📊 Risk Score Breakdown

Total Risk Score

95/100

Contributing Factors

Free Hosting

The use of free hosting (webflow.io) is a strong indicator of phishing. Legitimate services do not use this for login pages

Obfuscation Detected

Obfuscation indicates that the form is actively trying to hide its code and malicious intent.

🔬 Comprehensive Threat Analysis

Threat Type

Two-Factor Authentication Stealer

Target

KuCoin users (International)

Attack Method

Brand impersonation + credential harvesting forms + obfuscated JavaScript

Exfiltration Channel

Form submission (backend endpoint not detected - likely JavaScript-based)

Risk Assessment

HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Personal Info
2 obfuscation techniques

🏢 Brand Impersonation Analysis

Impersonated Brand

KuCoin

Official Website

https://www.kucoin.com/

Fake Service

KuCoin login page

⚔️ Attack Methodology

Primary Method: Credential Harvesting

The attacker is trying to steal the user's KuCoin login credentials by creating a fake login page that mimics the official KuCoin website. The form is likely designed to steal email and password information.