kiciuonlogxn[.]gitbook[.]io

The domain kiciuonlogxn.gitbook.io is confirmed to be a credential phishing site specifically targeting users of the KuCoin cryptocurrency exchange platform. Analysis indicates the site is currently offline, though it previously presented a fraudulent login interface mimicking the legitimate KuCoin portal. The page title, 'Login - KuCōin,' directly references the brand, employing a visually similar character substitution to deceive users. Infrastructure analysis reveals the domain was registered on April 08, 2026, through Cloudflare, Inc., and resolved to the IP address 104.18.40.47, associated with Cloudflare’s content delivery network in Canada. The SSL certificate was issued by Google Trust Services under the WE1 intermediate. Security vendors flagged the domain as malicious, with 18 out of 95 engines on VirusTotal detecting it as a phishing threat. Additionally, the domain appears on one security blocklist, and it was previously blocked by automated phishing detection systems. As of the latest assessment, the domain is offline, reducing immediate risk to end users. However, organizations should maintain blocklist entries for this domain and monitor for reactivation or similar infrastructure. Users who may have interacted with the site are advised to reset credentials on the legitimate KuCoin platform immediately and enable multi-factor authentication. Network administrators should review logs for connections to 104.18.40.47 and the domain name to identify potential compromise.