oauth----en---sso-kucoin[.]webflow[.]io

The domain oauth----en---sso-kucoin.webflow.io is actively hosting a site titled "Kucoin Sign-In: Your Gateway to the Crypto Market" and is classified as a high‑risk brand‑impersonation threat targeting KuCoin users. The domain was registered on March 04 2026 and resolves to IP 172.64.151.8, which belongs to Cloudflare (AS13335) in the United States. Infrastructure analysis shows the site runs on Webflow, is protected by Cloudflare, serves HTTP/3 traffic, and presents a Google Trust Services / WE1 SSL certificate. VirusTotal records indicate that 19 of 94 security vendors have flagged the domain, and it appears on a single security blocklist. PhishDestroy has already blocked the domain, and the HTTP response code is 200. Trust scoring services assign a 1/100 score on Scamadviser and 0/100 on Gridinsoft, underscoring the malicious nature of the site. The domain is registered through MarkMonitor, Inc., a registrar often used for legitimate brand assets, which may aid evasion. No additional content analysis is available beyond the page title, so the exact mechanism of credential capture remains unconfirmed. Defenders should immediately block the domain at network and endpoint layers, monitor DNS queries for the associated IP, and update detection rules to include the observed URL pattern. Continuous observation is advised to capture any evolution of the phishing infrastructure.