Is rewards-kucoin.pages.dev a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single landing page presented as the "Rewards Hub" of the KuCoin cryptocurrency brand. It is served from a free, shared Cloudflare Pages subdomain rather than from a standalone domain registered under that brand's name. Its apparent purpose is a rewards or promotional portal that invites visitors to engage with an exchange-branded incentive program. Full inspection was limited because the page sat behind an automated bot challenge, so only a short block of introductory text was captured and no products, yields or contact details could be read.

Scam/Impersonation Risk

Contradictory signals are present and decisive. Several major security vendors currently flag the site as malicious, and a further group rate it suspicious. The site is on external blacklists, which is a confirmed blacklisting rather than a soft reputational signal. The site trades on an established exchange brand while sitting on a generic hosting subdomain, and the brand name is the only identity cue the page offers. That combination is the classic structure of a rewards-lure or credential-harvesting page. Nothing independent links the page to the real brand's operator. The sandboxed behavioural runs showed some mitigating facts: no wallet-connect prompts, no clipboard manipulation, no hidden forms, no credential posts to third parties and no cloaking after interaction. The page nevertheless made a heavy volume of external requests, which means its content is largely assembled from outside sources. Because the bot challenge limited visibility, these clean behavioural results cannot offset the threat detections. The rewards framing of a crypto-brand page is a typical pretext for asking for logins, wallet connections or "claim" actions. Evidence:

• Homepage: titled "Rewards Hub | KuCoin" and carries the exchange brand on a free hosting subdomain, with no independent tie to the brand's operator.
• Reputation checks: 13 security engines rated the site malicious and 2 suspicious, including several tier-one vendors, and it appears on external blacklists.
• Domain provenance: the domain is about 2.1 years old, with 7 archive snapshots spanning 2024–2025 (2 years tracked).
• Sandbox: 74 external requests, about 89% of requests going to outside origins, across 3 successful runs with no wallet, clipboard or hidden-form activity.

Regulatory Verification Notes

No licensing, registration or legal-entity information could be obtained from the site. Capture was limited to the introductory text of one page, and no terms, privacy or about pages were available. No operator identity has been established for the site. Ownership and governance are opaque, which is a transparency limitation in itself and not an identity contradiction, because no conflicting legal-entity names were found. No third-party broker or regulatory-database record matched the site. The absence of such a record is therefore not evidence of authorisation. Nothing on the site supports any claim that it is an authorised arm of a regulated exchange. The valid certificate is a basic domain-validated one, which confirms only that traffic is encrypted and says nothing about who operates the site. Evidence:

• Technical: the site is served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: the TLS certificate was issued by WE1 at domain-validated (DV) level and is valid to 2027-01-06.
• Disclosure: the one captured page lists no company name, licence or registration number.
• Third-party registry: no broker-reputation record matched this site.

What to Verify Next

Before any interaction, the page's claim to be a KuCoin rewards program should be checked against the exchange's own channels. That means reaching its official site by typing the address directly or using a saved bookmark, and finding whether any such rewards program exists there. Any promotion should be confirmed through the exchange's verified support or announcement channels, not through links on this page. If the page was reached through a message, advertisement or social post, the sender and the originating channel should be reviewed and the message reported as suspicious. No wallet connection, seed phrase, login or identity document should be submitted to this site while these checks are open. Anyone who has already interacted with it should review their account activity, rotate credentials and revoke any wallet approvals. Evidence:

• Homepage: the rewards branding carries an exchange name but sits on a shared hosting subdomain.
• Reputation: current malicious detections and blacklist presence mean the site cannot be treated as a neutral unknown.
• Behavioural testing: the page's high proportion of external requests means its content may change without notice.

Summary Verdict

The overall posture is high risk. The site is a brand-themed page whose threat-intelligence record contradicts any presumption of legitimacy, and no independent identity evidence offsets it. The valid certificate and mainstream hosting are weak mitigating factors that do not change the classification.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and WAF, and every observed address is an edge node, so the real origin server is not visible. This is a mitigating factor only. It shows the site uses mainstream, well-run hosting, and the hosting provider is not itself implicated in the detections. The same edge-only visibility prevents independent verification of where the content is hosted and lets the underlying content be changed quickly without notice. Shared hosting of this kind is also free and anonymous to obtain, so it adds no assurance about the operator.

Closing Assessment

The site should not be used for login, credential entry, wallet connection or any financial action. Any reward or promotion claimed in the exchange's name should be confirmed only through the exchange's own official channels, and the page should be treated as unsafe until it is delisted by the security vendors that currently flag it.