kucoinpors[.]com

Analysis of kucoinpors.com shows a high‑risk, active brand‑impersonation campaign targeting the Blur brand with a fake exchange façade. The domain was registered on August 11 2025 through Gname.com Pte. Ltd. and resolves to IP 212.227.240.4, an address owned by AS8560 IONOS SE in the United States. Infrastructure indicators include a Let's Encrypt R13 certificate, Nginx serving Vue.js content, HSTS enforcement, and shared DNS resolvers a5.share-dns.com and b5.share-dns.net. The site returns HTTP 200 and has a Gridinsoft trust score of 0/100, reflecting extreme malicious confidence. It appears on a single security blocklist and is actively listed by PhishDestroy. VirusTotal records 14 of 95 scanners flagging the domain, and Google Safe Browsing flags it for social engineering. The campaign’s primary vector is a fake exchange that pretends to be affiliated with Blur, though the exact page content has not been examined. Defenders should immediately block DNS resolution to 212.227.240.4, add kucoinpors.com to URL filtering and email security policies, and monitor for related activity leveraging the same nameservers or certificate. Because the site employs legitimate TLS, additional heuristic detection (e.g., rapid domain creation, low trust scores, and brand‑impersonation tags) should be used to catch similar future infrastructure. Continuous threat‑intel feeds should be consulted for any new indicators tied to this domain.