web-kucoin[.]pages[.]dev

PhishDestroy identifies an active KuCoin brand impersonation campaign targeting users via the domain web-kucoin.pages.dev. This threat is classified as under investigation due to recent domain age and low detection rates, but poses immediate risk to cryptocurrency users seeking legitimate KuCoin services. The domain leverages Cloudflare’s infrastructure and a Google Trust Services SSL certificate to appear legitimate, while resolving to IP 172.66.47.97.

This domain shows 0 detections out of 95 scans on VirusTotal, indicating it has evaded most security engines. Registered through Cloudflare, Inc., it resolves to IP 172.66.47.97 and is hosted on Google Trust Services infrastructure, which may delay takedowns. The combination of a recently registered .pages.dev subdomain and zero blocklist presence increases the risk of successful deception. Users are advised to avoid clicking links to this domain and verify all URLs against official KuCoin domains.

To mitigate exposure, users should bookmark the official KuCoin domain (kucoin.com) and avoid accessing services via third-party links. Enterprises should block 172.66.47.97 at the firewall and monitor DNS resolutions for web-kucoin.pages.dev. Report any interactions with this domain to KuCoin’s fraud team and update threat intelligence feeds to include this domain as a known impersonation site. Avoid enabling scripts or downloading files from this domain under any circumstances.