KuCoin Phishing Kit 8fo0kgp3

Detects a KuCoin phishing kit deployed often on replit.com.

References

Recent Detections

None found yet

We've not seen any sites matching this indicator yet. Try scanning a site you think matches this rule:

IOK Rule (edit)

title: KuCoin Phishing Kit 8fo0kgp3
description: |
    Detects a KuCoin phishing kit deployed often on replit.com.

references:
    - https://urlscan.io/result/768a3795-b37c-44c4-9ff3-8bd14dc0ec97

detection:

    title:
      html|contains:
        - <title>Iniciar SesiĆ³n | KuCoin</title>

    form:
      html|contains|all:
        - form action="step.php" method="post"
        - class="cointer"

    loginEmail:
      html|contains|all:
        - <a href="celu.html">Celular</a>
        - <td id="db">Email</td>
        - <td id="dc">con codigo QR</td>

    loginPhone:
      html|contains|all:
        - <td id="da">Celular</td>
        - <a href="ku.html">Email</a>
        - <td id="dc">con codigo QR</td>

    condition: title and form and (loginEmail or loginPhone)

tags:
  - target.kucoin
  - target_country.argentina