SafeMode - Analysis: kucinsh-lgin.webflow.io

Captura Visual

Información de Detección

http://kucinsh-lgin.webflow.io

Detected Brand

KuCoin

Country

International

Confianza

100%

HTTP Status

200

Report ID

7a4a331d-437…

Analyzed

2026-03-13 00:39

Final URL (after redirects)

https://kucinsh-lgin.webflow.io/

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T163E1E82FC20806111B218569BEB513CDE39F044CF3614AEA2EB8D07D72BA7914E3769F
CONTENT ssdeep	192:gbnTPJT8bQstE8R+29SP/TRgz9ikUoTf+ZEVaey4:gbn7JT8bQstE8M29SY+YmKaey4

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	bdd29268c26c3e93
VISUAL aHash	ffffbfffff81817f
VISUAL dHash	ac3b3b631b2b33e0
VISUAL wHash	fe0b0999fb81811f
VISUAL colorHash	07200000600
VISUAL cropResistant	ac3b3b631b2b33e0,139dcdcf98adad54,a9acd69ce28e2c8c,69ac9c8c9a4cd819,a0a78eae8c8c9a15

Análisis de Código

Risk Score 73/100

Nivel de Amenaza ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Personal Info

🔬 Threat Analysis Report

• Amenaza: Phishing
• Objetivo: Usuarios de KuCoin
• Método: Suplantación de identidad a través de alojamiento gratuito.
• Exfil: Probablemente roba credenciales de inicio de sesión. Obfuscación detectada.
• Indicadores: Alojamiento gratuito, logotipo de la marca, texto de Iniciar sesión/Registrarse.
• Riesgo: ALTO

🔒 Obfuscation Detected

fromCharCode

📊 Desglose de Puntuación de Riesgo

Total Risk Score

95/100

Contributing Factors

Free Hosting

Free hosting provider is a primary indicator of phishing.

Brand Impersonation

The site attempts to mimic the KuCoin website.

Obfuscation

Obfuscation detected, likely to hide malicious code.

🔬 Análisis Integral de Amenazas

Tipo de Amenaza

Two-Factor Authentication Stealer

Objetivo

KuCoin users (International)

Método de Ataque

Brand impersonation + credential harvesting forms + obfuscated JavaScript

Canal de Exfiltración

Form submission (backend endpoint not detected - likely JavaScript-based)

Evaluación de Riesgo

HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Personal Info
2 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Impersonated Brand

KuCoin

Official Website

https://www.kucoin.com/

Fake Service

KuCoin login

⚔️ Metodología de Ataque

Primary Method: Credential Harvesting

The attacker aims to steal the user's KuCoin login credentials by presenting a fake login form on a domain under their control, deployed on a free hosting platform. User enters their information, and the attacker receives it.

Secondary Method: Malicious Script Injection

The site may contain JavaScript designed to steal data, redirect to other phishing sites, or install malware. The fromCharCode function suggests that javascript obfuscation is in use.