oauth----en---sso--kucoin[.]webflow[.]io

This domain, oauth----en---sso--kucoin.webflow.io, is identified as a brand impersonation threat targeting KuCoin, a cryptocurrency exchange platform. The site is designed to mimic legitimate KuCoin authentication portals, likely for credential theft or account takeover attempts. As of the latest verification, the domain has been taken offline, though prior activity remains a concern for security teams. Analysis indicates the domain was flagged by 19 of 95 security vendors on VirusTotal, signaling broad detection as malicious. It was registered through NameCheap, Inc. and resolved to the IP address 104.18.36.248, hosted on Cloudflare’s infrastructure (AS13335). The domain was created on February 21, 2026, and appears on at least one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common but not exclusive indicator of legitimacy, often exploited by threat actors to lend false credibility. Given the domain’s current offline status, immediate threats are mitigated; however, infrastructure reuse or re-registration remains possible. Organizations are advised to block the domain and associated IP at perimeter security controls. Users should verify all authentication requests via official KuCoin channels and report any suspicious activity to their security operations teams. Monitoring for similar typosquatting or brand-impersonation domains is recommended, particularly those leveraging Cloudflare hosting or NameCheap registrations.