app[.]kucoin-io[.]top

The domain app.kucoin-io.top is a sophisticated brand impersonation threat specifically targeting users of the legitimate cryptocurrency exchange KuCoin. This domain was designed to deceive visitors into believing they are accessing official KuCoin services, likely to steal login credentials, private keys, or seed phrases through a fake login page or crypto drainer. The domain is currently offline, having been taken down after security researchers flagged its malicious activity.

Technical analysis reveals that app.kucoin-io.top resolves to IP address 176.97.117.190 and was registered through Gname.com Pte. Ltd. on April 19, 2026, a recent creation date consistent with phishing campaigns. VirusTotal data shows that 21 out of 95 security vendors flagged this domain as malicious, and it appears on at least one security blocklist. The domain uses an SSL certificate issued by Let's Encrypt (R12), which provides a false sense of security to unsuspecting victims. The page title was set to "KuCoin" to further the impersonation.

Given that the domain is now offline, the immediate risk of credential compromise is reduced, but users should remain vigilant. PhishDestroy recommends that anyone who may have interacted with this domain change their KuCoin account passwords immediately, enable two-factor authentication, and monitor their accounts for unauthorized transactions. Always verify the official KuCoin URL (kucoin.com) before entering sensitive information. Report any similar suspicious domains to security teams to help protect the broader crypto community.