kucoen[.]com

Analysis indicates that kucoen.com is an active brand-impersonation campaign targeting KuCoin users. The domain was registered on February 21, 2026 through Gransy, s.r.o. and resolves to the IP address 178.218.218.30, which belongs to AS42244 eServer s.r.o. in Russia. The host provides no TLS certificate, and an HTTP request returns a 200 status code with the page title "kucoen.com".

Four Russian‑based nameservers (ns1.ru.eserver.net through ns4.ru.eserv) resolve the domain, suggesting a centralized hosting arrangement. Infrastructure reputation is poor: the Gridinsoft trust score is 0 out of 100, and the domain appears on three external blocklists. Defensive feeds have already flagged the site; it is blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans show a single detection out of 93 security vendors, confirming that at least one vendor identified malicious behavior.

No additional content analysis is available, so the exact phishing page layout, credential‑capture mechanisms, or payload delivery methods remain unknown. Defenders should add kucoen.com and its resolving IP 178.218.218.30 to network and DNS blocklists, enforce TLS‑only policies to prevent fallback to unsecured HTTP, and monitor for any traffic patterns that match the known host. Endpoint security solutions should be updated to include the domain in their malicious URL signatures, and user education campaigns should warn KuCoin users about unsolicited login prompts that may originate from look‑alike URLs such as kucoen.com. Continuous re‑evaluation is advised, as further threat intelligence (e.g., payload samples or additional vendor detections) may emerge.