kucoin-com-oauth[.]pages[.]dev

This domain, kucoin-com-oauth.pages.dev, is identified as a brand impersonation threat targeting KuCoin, a cryptocurrency exchange platform. Analysis indicates the site was designed to mimic legitimate KuCoin authentication portals, likely to harvest user credentials or facilitate unauthorized account access. No direct evidence of a crypto drainer kit was observed, but the domain structure and branding align with credential theft campaigns. The use of a subdomain under Cloudflare Pages suggests an attempt to exploit trusted infrastructure for legitimacy. Technical indicators confirm elevated risk. The domain was registered on October 07, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, associated with AS13335. VirusTotal detection shows 17 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Google Trust Services (WE1), a common practice among phishing operators to appear secure. The domain appears on two security blocklists and was proactively blocked by at least two threat intelligence platforms. No Google Safe Browsing (GSB) listing was confirmed at the time of analysis. The domain is currently offline, mitigating immediate user exposure. However, the infrastructure remains registered, and the rapid deployment of similar domains under Cloudflare Pages has been observed in past campaigns. Organizations should monitor for re-emergence under altered subdomains or related IPs. Users are advised to verify domain authenticity before entering credentials and enable multi-factor authentication on cryptocurrency accounts. Security teams should update blocklists to include this domain and its associated IP, while investigating potential lateral movement from compromised credentials.