SafeMode - Analysis: kucinsh-lgin.webflow.io

Visual Capture

Detection Info

http://kucinsh-lgin.webflow.io

Detected Brand

KuCoin

Country

International

Confidence

100%

HTTP Status

200

Report ID

7a4a331d-437…

Analyzed

2026-03-13 00:39

Final URL (after redirects)

https://kucinsh-lgin.webflow.io/

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T163E1E82FC20806111B218569BEB513CDE39F044CF3614AEA2EB8D07D72BA7914E3769F
CONTENT ssdeep	192:gbnTPJT8bQstE8R+29SP/TRgz9ikUoTf+ZEVaey4:gbn7JT8bQstE8M29SY+YmKaey4

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	bdd29268c26c3e93
VISUAL aHash	ffffbfffff81817f
VISUAL dHash	ac3b3b631b2b33e0
VISUAL wHash	fe0b0999fb81811f
VISUAL colorHash	07200000600
VISUAL cropResistant	ac3b3b631b2b33e0,139dcdcf98adad54,a9acd69ce28e2c8c,69ac9c8c9a4cd819,a0a78eae8c8c9a15

Code Analysis

Risk Score 73/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Personal Info

🔬 Threat Analysis Report

• Threat: Phishing
• Target: KuCoin users
• Method: Impersonation via free hosting.
• Exfil: Likely steals login credentials.  Obfuscation detected.
• Indicators: Free hosting, brand logo, Sign in/Log In text.
• Risk: HIGH

🔒 Obfuscation Detected

fromCharCode

📊 Risk Score Breakdown

Total Risk Score

95/100

Contributing Factors

Free Hosting

Free hosting provider is a primary indicator of phishing.

Brand Impersonation

The site attempts to mimic the KuCoin website.

Obfuscation

Obfuscation detected, likely to hide malicious code.

🔬 Comprehensive Threat Analysis

Threat Type

Two-Factor Authentication Stealer

Target

KuCoin users (International)

Attack Method

Brand impersonation + credential harvesting forms + obfuscated JavaScript

Exfiltration Channel

Form submission (backend endpoint not detected - likely JavaScript-based)

Risk Assessment

HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Personal Info
2 obfuscation techniques

🏢 Brand Impersonation Analysis

Impersonated Brand

KuCoin

Official Website

https://www.kucoin.com/

Fake Service

KuCoin login

⚔️ Attack Methodology

Primary Method: Credential Harvesting

The attacker aims to steal the user's KuCoin login credentials by presenting a fake login form on a domain under their control, deployed on a free hosting platform. User enters their information, and the attacker receives it.

Secondary Method: Malicious Script Injection

The site may contain JavaScript designed to steal data, redirect to other phishing sites, or install malware. The fromCharCode function suggests that javascript obfuscation is in use.