kukoin-login[.]gitbook[.]io

This domain kukoin-login.gitbook.io is assessed as a brand impersonation phishing page targeting KuCoin users. The infrastructure hosts a counterfeit login interface designed to capture exchange credentials, potentially enabling unauthorized account access and asset theft. The page title observed, “Kucoin Loℊin | Loℊ In Kucoin,” indicates deliberate visual spoofing of legitimate authentication portals to deceive users into submitting sensitive login information.

Technical indicators confirm VirusTotal detection at 18/95 security vendors. The domain is associated with Cloudflare, Inc. infrastructure and resolves to IP 172.64.147.209 (AS13335, US). The SSL certificate is issued by Google Trust Services (WE1). The domain was originally created on March 30, 2014, and appears on 2 security blocklists, including PhishDestroy and PhishingDB. These factors collectively indicate a hosted phishing page leveraging legitimate infrastructure for abuse.

Users who interacted with this page should assume credential compromise. Immediate mitigation includes resetting KuCoin credentials, revoking active sessions, and enabling or refreshing multi-factor authentication. Any reused passwords across other services should also be changed to prevent cross-account takeover. Security logs should be reviewed for unauthorized login attempts originating from Cloudflare edge IP ranges, including 172.64.147.209, and further monitoring should be applied to detect secondary compromise activity.