wel-come-io-kucoin[.]pages[.]dev

This domain is flagged for impersonating KuCoin, a cryptocurrency exchange platform. Visitors to wel-come-io-kucoin.pages.dev are presented with a fake login portal titled 'KuCoin: Log In | Sign In,' designed to harvest credentials or facilitate unauthorized access to user accounts. The site poses a direct financial risk, as stolen credentials could lead to theft of cryptocurrency assets or unauthorized transactions on the victim's behalf. Infrastructure analysis reveals the domain is hosted on Cloudflare infrastructure, a common tactic to obscure the true origin of malicious activity and leverage reputable service providers to evade detection. Analysis indicates the domain was created on October 09, 2025, and is registered through Cloudflare, Inc. Security vendors on VirusTotal flagged this domain as malicious, with 14 out of 95 engines detecting it as a threat. The domain appears on at least one security blocklist and resolves to the IP address 188.114.96.3, associated with Cloudflare's network (AS13335). The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate, does not mitigate the malicious intent of the domain. The combination of brand impersonation, recent registration, and detection by multiple security engines underscores the elevated risk level. Users who visited wel-come-io-kucoin.pages.dev or entered credentials on the site should immediately revoke access to any linked accounts and enable multi-factor authentication where available. Monitor all associated cryptocurrency wallets and exchange accounts for unauthorized transactions. If credentials were entered, assume they are compromised and update passwords for all accounts where the same credentials may have been reused. Report the incident to the impersonated platform's security team for further investigation. Network administrators should block the domain and associated IP address (188.114.96.3) at the perimeter to prevent further access.