kucoin[.]codes

The domain kucoin.codes is a convincing imitation of the legitimate KuCoin cryptocurrency exchange platform, designed to trick users into entering their login credentials and potentially drain their digital assets. This type of brand impersonation is a common phishing tactic where victims are lured via email, social media, or search ads to a fake site that looks nearly identical to the real KuCoin interface. Once a user logs in, the attackers capture the username, password, and possibly two-factor authentication codes, leading to unauthorized access and theft of cryptocurrency funds.

This phishing site was discovered and analyzed by PhishDestroy, with technical indicators confirming its malicious intent. The domain was registered on June 2, 2026, through Dynadot Inc, a relatively recent creation that aligns with phishing campaigns. VirusTotal data shows that 5 out of 95 security vendors flagged the domain as malicious, while it also appears on three separate security blocklists. The site uses an SSL certificate issued by Let's Encrypt (YR1) and resolves to IP address 54.215.31.113. The page title was simply "kucoin.codes," and the site is now offline, but other similar domains may still be active.

If you have visited kucoin.codes or entered any credentials, immediately change your KuCoin account password and enable two-factor authentication if not already done. Also, contact KuCoin support to report the incident and check for any unauthorized transactions. Run a full security scan on your device to detect any malware or keyloggers. As a precaution, always verify the official KuCoin URL by bookmarking it or typing it directly in your browser, and never click on links from unsolicited messages. For real-time verification of suspicious domains, use PhishDestroy's lookup tool to check if a site is safe before interacting with it.