oauth---apps--sso---kucoin[.]webflow[.]io

oauth---apps--sso---kucoin.webflow.io is an active Webflow‑hosted domain first observed on November 10 2025. DNS resolution points to 172.64.151.8, an IP address owned by Cloudflare, Inc. in Canada, and the site serves HTTP/3 traffic with an HTTP 200 response code. The TLS certificate is issued by Google Trust Services under the WE1 label, providing standard Cloudflare edge encryption. The landing page’s title, “Kucoin Sig‑in | Secure Your Crypto Trading Platform,” directly copies the KuCoin brand and is designed to lure cryptocurrency traders into submitting login credentials, a classic brand‑impersonation vector targeting the KuCoin user base.

Reputation engines rate the site extremely unfavorably. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal records 18 of 95 security vendors flagging the domain as malicious. The domain appears on one public security blocklist and is actively blocked by PhishDestroy, confirming its presence in multiple threat‑intel feeds. The combination of a zero trust score, multiple vendor detections, and the classification as a high‑risk, cryptocurrency‑type scam aligns with a high‑confidence brand‑impersonation campaign aimed at harvesting KuCoin credentials.

While the technical footprint is well documented, details about the underlying phishing kit, any associated command‑and‑control servers, or additional payload delivery mechanisms remain unknown. Defensive operators should therefore add both the domain name and its resolved IP address to outbound and inbound filtering policies, enforce strict domain‑based authentication for legitimate KuCoin communications, and require multi‑factor authentication for user accounts. Continuous monitoring of the TLS certificate for changes, regular re‑scanning of the host on VirusTotal, and inclusion of the indicator in local blocklists are recommended to reduce exposure while the domain remains active.