auth--kucoin-helpp[.]webflow[.]io

PhishDestroy identifies the domain auth--kucoin-helpp.webflow.io as an active brand impersonation site currently impersonating the global cryptocurrency exchange KuCoin. The infrastructure is classified as an elevated-risk threat with confirmed malicious intent targeting users through deceptive replication of KuCoin’s brand assets and support interfaces. This domain has been assessed as active and remains accessible to visitors, posing imminent danger to individuals seeking legitimate customer support or login portals.

This domain was flagged by 20 of 95 VirusTotal security vendors and resolves to IP address 104.18.36.248. The domain is hosted on Webflow and secured with a Google Trust Services SSL certificate, which does not indicate legitimacy given the malicious content. Security telemetry indicates this infrastructure is part of a broader wave of KuCoin impersonation campaigns observed since early 2024, often leveraging typosquatting and lookalike branding to harvest credentials and initiate crypto drainage via fake withdrawal pages.

The current status of auth--kucoin-helpp.webflow.io is active and operational. PhishDestroy strongly recommends immediate network and user-level defensive actions: block the domain and IP (104.18.36.248) at the firewall and DNS level, update threat intelligence feeds, and issue advisories to users advising against interaction. Organizations should also monitor endpoints for signs of credential compromise or crypto wallet access. This domain exemplifies the sophistication of modern crypto drainers and reinforces the need for continuous monitoring and user security awareness training focused on brand impersonation and support scams.