ku-coin-login-aht[.]pages[.]dev

This domain is an active brand impersonation threat designed to deceive users into entering their login credentials for KuCoin, a major cryptocurrency exchange. The site mimics the official KuCoin sign-in page, complete with a fraudulent security tips section, to trick victims into disclosing sensitive account information. Such attacks often lead to unauthorized access, financial theft, or further exploitation through malware distribution. Users who interact with this domain risk immediate account compromise and potential loss of digital assets stored on the platform.

Analysis indicates this is a sophisticated impersonation attempt with multiple technical red flags. The domain was registered on September 18, 2025, through Cloudflare, Inc., and is currently flagged by 17 out of 95 security vendors on VirusTotal. It appears on one security blocklist and is explicitly blocked by PhishDestroy. The SSL certificate, issued by Google Trust Services, resolves to a Cloudflare IP address (172.66.44.147) located in Canada. The page title, 'KuCoin Sign In: Security Tips Before Entering Your Credentials,' is crafted to appear legitimate while exploiting user trust in security advisories.

If you visited ku-coin-login-aht.pages.dev and entered any credentials, take immediate action to secure your account. First, disconnect any active sessions on the official KuCoin platform and revoke access to all connected devices or applications. Change your password using a strong, unique combination and enable multi-factor authentication if not already active. Monitor your account for unauthorized transactions and report any suspicious activity to KuCoin support. Consider scanning your device for malware, as phishing sites may deploy additional payloads. Avoid interacting with any communications from this domain, including emails or messages, and verify all future login attempts through the official KuCoin website or application.