# oauth---apps--sso---kucoin.webflow.io — MALICIOUS

> PhishDestroy identifies oauth---apps--sso---kucoin.webflow.io as an active KuCoin brand impersonation phishing domain flagged by 20 of 95 VirusTotal vendors.

## Summary
PhishDestroy identifies the domain oauth---apps--sso---kucoin.webflow.io as an active KuCoin brand impersonation phishing campaign. The domain is currently operational and mimics KuCoin's official authentication infrastructure to deceive users into divulging credentials or sensitive data.

This domain was flagged by 20 of 95 VirusTotal security vendors, resolving to IP 172.64.151.8 under a Google Trust Services SSL certificate. The Webflow.io subdomain structure suggests leveraging a reputable hosting platform to evade immediate detection, though the impersonation of KuCoin's SSO and OAuth interfaces is the primary threat vector. The domain's recent creation and presence on multiple blocklists further indicate its malicious intent.

Current status is active, with no signs of takedown. Users should immediately block this domain at the network and endpoint levels. Organizations are advised to update threat intelligence feeds and warn employees against interacting with any communications referencing this domain or KuCoin SSO/OAuth processes. Security teams should also review logs for past interactions with this domain to assess potential compromise.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)
- Target brand: KuCoin

## Domain Intelligence
- Registrar: REGISTRAR_NOT_FOUND
- IP: 172.64.151.8

## Detection Status
- VirusTotal: 20 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/898b8314-ce52-4f22-b42e-63b3b68d664e
- PhishDestroy: https://phishdestroy.io/domain/oauth---apps--sso---kucoin.webflow.io/
- LLM endpoint: https://phishdestroy.io/domain/oauth---apps--sso---kucoin.webflow.io/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/oauth---apps--sso---kucoin.webflow.io/
Last updated: 2026-03-21