kucoin-lxgen[.]gitbook[.]io

This domain is flagged as an elevated-risk brand impersonation threat targeting KuCoin, a cryptocurrency exchange platform. Analysis indicates the site operates as a credential harvesting portal, presenting a login interface under the title 'kucoin @ Login' to deceive users into submitting sensitive authentication details. The infrastructure and content are designed to mimic legitimate KuCoin services, increasing the likelihood of successful compromise for unsuspecting victims. Infrastructure analysis reveals the domain kucoin-lxgen.gitbook.io was registered through Cloudflare, Inc. and resolves to the IP address 104.18.40.47, located in Canada under Cloudflare’s network. The domain was originally created on March 30, 2014, though the current malicious activity suggests recent repurposing. Security vendor detection on VirusTotal stands at 18 out of 95 engines, indicating moderate but notable consensus regarding its malicious nature. The domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious sites. The page title explicitly references KuCoin, reinforcing the brand impersonation tactic. Mitigation against this threat involves immediate domain blacklisting at the network and endpoint levels, particularly for entities handling cryptocurrency transactions. Organizations should update detection rules to flag domains hosted on 104.18.40.47 or associated with Cloudflare registrations exhibiting brand impersonation patterns. User education should emphasize verifying domain authenticity before entering credentials, especially for financial or cryptocurrency platforms. Monitoring for similar domains registered under GitBook or Cloudflare infrastructure may help preempt future campaigns leveraging the same tactics.