kukoenvee-idd[.]gitbook[.]io

This domain, kukoenvee-idd.gitbook.io, is flagged as a brand impersonation threat targeting KuCoin, a major cryptocurrency exchange platform. Analysis of the page title, Bitcổin & Cryptổ Exchange | Kúcổin Lổgin, reveals deliberate character substitution tactics designed to mimic the legitimate KuCoin login interface. The domain appears engineered to harvest user credentials, likely feeding into a cryptocurrency drainer kit or unauthorized account access scheme. No explicit drainer kit signatures were observed, but the infrastructure aligns with credential phishing campaigns targeting financial services. Infrastructure analysis reveals the following technical indicators: the domain was registered on May 11, 2026, through GitBook, resolving to IP address 104.18.40.47, geolocated to a Cloudflare node in Canada. VirusTotal reports 17 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing status remains unconfirmed. The domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1). The creation date is notably in the future, suggesting either a data entry anomaly or an attempt to evade temporal-based detection mechanisms. The domain is currently offline, having been taken down following detection by security blocklists and automated threat response systems. While the immediate threat is mitigated, residual risk persists due to potential re-registration or migration to alternative infrastructure. Users who may have interacted with the domain are advised to rotate credentials immediately, enable multi-factor authentication, and monitor accounts for unauthorized transactions. Organizations should update internal blocklists to include this domain and its associated IP address to prevent future exposure.