SafeMode - Analysis: kucinsh-lgin.webflow.io

Captura Visual

Información de Detección

https://kucinsh-lgin.webflow.io/

Detected Brand

KuCoin

Country

International

Confianza

100%

HTTP Status

200

Report ID

11200e16-03a…

Analyzed

2026-03-12 09:07

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T163E1E82FC20806111B218569BEB513CDE39F044CF3614AEA2EB8D07D72BA7914E3769F
CONTENT ssdeep	192:gbnTPJT8bQstE8R+29SP/TRgz9ikUoTf+ZEVaey4:gbn7JT8bQstE8M29SY+YmKaey4

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	bdd29268c26c3e93
VISUAL aHash	ffffbfffff81817f
VISUAL dHash	ac3b3b631b2b33e0
VISUAL wHash	fe0b0999fb81811f
VISUAL colorHash	07200000600
VISUAL cropResistant	ac3b3b631b2b33e0,139dcdcf98adad54,a9acd69ce28e2c8c,69ac9c8c9a4cd819,a0a78eae8c8c9a15

Análisis de Código

Risk Score 73/100

Nivel de Amenaza ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Personal Info

🔬 Threat Analysis Report

• Amenaza: Phishing
• Objetivo: Usuarios de KuCoin
• Método: Suplantación de identidad a través de alojamiento gratuito
• Exfil: Probablemente roba credenciales de inicio de sesión. La ofuscación sugiere intentos de ocultar la exfiltración de datos.
• Indicadores: Alojamiento gratuito, logotipo de marca, enlace 'Iniciar sesión', detección de ofuscación de formularios. Formularios detectados.
• Riesgo: Alto

🔒 Obfuscation Detected

fromCharCode

📊 Desglose de Puntuación de Riesgo

Total Risk Score

95/100

Contributing Factors

Free Hosting

The use of free hosting (webflow.io) is a strong indicator of phishing. Legitimate services do not use this for login pages

Obfuscation Detected

Obfuscation indicates that the form is actively trying to hide its code and malicious intent.

🔬 Análisis Integral de Amenazas

Tipo de Amenaza

Two-Factor Authentication Stealer

Objetivo

KuCoin users (International)

Método de Ataque

Brand impersonation + credential harvesting forms + obfuscated JavaScript

Canal de Exfiltración

Form submission (backend endpoint not detected - likely JavaScript-based)

Evaluación de Riesgo

HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Personal Info
2 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Impersonated Brand

KuCoin

Official Website

https://www.kucoin.com/

Fake Service

KuCoin login page

⚔️ Metodología de Ataque

Primary Method: Credential Harvesting

The attacker is trying to steal the user's KuCoin login credentials by creating a fake login page that mimics the official KuCoin website. The form is likely designed to steal email and password information.