kucooindogn[.]gitbook[.]io

This domain, kucooindogn.gitbook.io, is flagged as a crypto wallet drainer hosted on GitBook infrastructure. Analysis indicates the site impersonates legitimate cryptocurrency wallet interfaces, likely targeting users of decentralized finance platforms. No explicit brand impersonation is confirmed, but the site employs common drainer kit tactics, including wallet connection prompts and transaction spoofing to siphon funds. The domain does not exhibit overt branding of major exchanges or services, suggesting a generic but highly targeted phishing approach. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.64.147.209, located in California and operated by Cloudflare, Inc. It was created on May 20, 2026, an anomalous future date that may indicate domain registration manipulation or data obfuscation. The SSL certificate is issued by Google Trust Services (WE1), a common but not inherently malicious provider. VirusTotal reports 17 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. Google Safe Browsing status is not explicitly provided, but the domain is blocked by at least one major threat intelligence feed. The domain is currently offline, likely due to takedown actions or infrastructure suspension. Despite its inactive status, residual risk remains elevated due to the potential for rehosting or domain repurposing. Users who interacted with the site should assume wallet compromise and take immediate action: revoke all connected dApp permissions, transfer remaining funds to a secure wallet, and monitor transaction histories for unauthorized activity. Organizations should update blocklists to include the domain and associated IP, while security teams should investigate potential lateral movement or secondary infections linked to this phishing campaign.