kucoinporv[.]com

On 21 February 2026 the domain kucoinporv.com was registered through Gname.com Pte. Ltd. The registration date places the infrastructure in the same calendar year as the observed malicious activity. DNS resolution points to the IPv4 address 159.138.247.173, which belongs to the Huawei Cloud AS136907 network located in Thailand. The domain uses the public recursive nameservers a.share-dns.com and b.share-dns.net, a pattern commonly observed in disposable hosting setups. No TLS certificate is presented for the site, indicating that any HTTP connections would be unencrypted.

The HTTP response, captured before the site was taken offline, presented the page title “KuCoinpor”, matching the supplied brand target “KuCoin”. This title, together with the classification “Crypto Scam” in the intelligence feed, suggests an attempt to masquerade as a KuCoin service to lure cryptocurrency users. VirusTotal analysis recorded two positive detections out of ninety‑three scanners, and the domain appears on a single external blocklist. Additionally, the PhishDestroy community has already added the domain to its blocklist, confirming that at least one defensive organization recognized the threat.

Current status shows the site offline, limiting immediate victim exposure, but the underlying hosting provider and IP address remain active and could be reused for future impersonation campaigns. Defenders should therefore consider adding both the fully‑qualified domain name and the associated IP address to network‑level blocklists, monitor the registrar Gname.com for new domains created with similar naming patterns, and enforce strict outbound filtering for unencrypted HTTP traffic to the identified nameservers. Continuous re‑scanning of the IP on threat‑intel platforms is advisable to detect any re‑activation.