kucoin-logini[.]gitbook[.]io

This domain, kucoin-logini.gitbook.io, is a credential phishing site designed to impersonate the KuCoin cryptocurrency exchange. The page presents a fraudulent login interface titled 'KÚCÔIN LÔGIN | BITCÔIN,' mimicking legitimate KuCoin branding to deceive users into submitting account credentials. Analysis indicates the site specifically targets individuals involved in cryptocurrency transactions, exploiting trust in the KuCoin brand to harvest sensitive login details for unauthorized access to digital asset accounts. Infrastructure analysis reveals the domain was registered on March 14, 2026, and resolves to the IP address 104.18.40.47, hosted on Cloudflare’s network (AS13335). The domain appears on one security blocklist and is flagged by 12 out of 95 security vendors on VirusTotal, confirming its malicious classification. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the threat, as phishing sites frequently use valid certificates to appear legitimate. The domain’s registration through Cloudflare further complicates attribution, as it leverages widely used infrastructure to evade detection. Users who visited kucoin-logini.gitbook.io should immediately revoke any entered credentials and enable multi-factor authentication on their KuCoin accounts. All passwords associated with the account should be changed, and any connected devices should be scanned for malware. If financial transactions were initiated through the site, affected individuals should report the incident to their financial institution and relevant cybersecurity authorities. Monitoring for unauthorized access or unusual activity on linked accounts is strongly advised.