kucoinpork[.]vip

The domain kucoinpork.vip was registered on February 21, 2026 through Gname.com Pte. Ltd. and is currently listed as offline. Technical analysis shows the domain resolves to IP address 172.67.201.220, which belongs to the Cloudflare network (AS13335) and is geolocated to the United States. The authoritative nameservers are expire1.gname-dns.com and expire2.gname-dns.com. No SSL certificate is presented for the site, indicating that HTTPS is not enforced. The page title returned by HTTP queries is the literal string "kucoinpork.vip", providing no additional context about the page content.

Reputation services have flagged the domain across multiple vectors. It appears on a single security blocklist and is actively blocked by PhishDestroy. Google Safe Browsing classifies the site as a social engineering threat, and VirusTotal reports that 9 of 93 scanning engines have identified the domain as malicious. The threat type is recorded as brand impersonation, specifically targeting the cryptocurrency exchange KuCoin, and the scam category is identified as a crypto scam.

Because the site is offline, direct content inspection could not be performed, leaving the exact phishing layout and credential capture mechanisms unknown. However, the convergence of blocklist inclusion, Google Safe Browsing labeling, and multiple vendor detections provides strong confidence that the domain was used to lure victims into a KuCoin‑related fraud campaign. Defenders should immediately block the domain and its associated IP address at perimeter and DNS filtering layers. Monitoring for any future resolution changes to the IP, as well as for newly observed sub‑domains under the same registrar or nameserver pair, is advised. Email security gateways should be updated to flag any communications referencing KuCoin that originate from unauthenticated sources, and users should be reminded to verify URLs against official KuCoin domains before entering credentials.