kukoenbsz-iss[.]gitbook[.]io

This domain is flagged as an elevated-risk phishing resource specifically designed to impersonate the KuCoin cryptocurrency exchange login portal. Analysis indicates the page title, 'Bitcổin & Cryptổ Exchange | Kúcổin Lổgin,' employs character substitution to mimic the legitimate platform while soliciting user credentials under false pretenses. Infrastructure analysis reveals the domain kukoenbsz-iss.gitbook.io resolves to the IP address 104.18.40.47, geolocated within the United States and associated with AS13335 (Cloudflare, Inc.). The domain was registered through Cloudflare, Inc. on March 30, 2014, though the phishing content appears to have been deployed more recently. Security vendor detections on VirusTotal report 17 out of 95 engines flagging the domain as malicious. The resource is currently listed on one security blocklist and has been taken offline following identification by automated threat detection systems. Mitigation against this type of credential-harvesting attack involves implementing multi-factor authentication (MFA) for all cryptocurrency exchange accounts, particularly those handling high-value transactions. Users should verify domain authenticity by cross-referencing official exchange URLs and inspecting for subtle character substitutions in the address bar. Organizations are advised to update web filtering rules to block domains hosted on content delivery networks exhibiting phishing indicators, such as anomalous subdomain structures or recently modified pages impersonating financial services. Network administrators should monitor for connections to 104.18.40.47 and similar Cloudflare-hosted IPs displaying cryptocurrency-themed phishing patterns.