k[.]lig9qbn[.]cn

Analysis of the domain k.lig9qbn.cn shows it was registered on November 11, 2024 through the registrar 茂名市群英网络有限公司 and is currently taken offline. The domain resolves to the IP address 156.226.74.36, which is advertised as being located in Hong Kong and is announced under ASN 135097 (LUOGELANG (FRANCE) LIMITED). The authoritative name servers are ns1.judns.com and ns2.judns.com. No TLS certificate is presented for the site, indicating that HTTPS was not employed.

The page title retrieved from the host – “欧亿交易所- 欧亿app官方下载,值得信赖 - 欧 易下载” – does not reference the targeted brand, yet the intelligence tags the campaign as a brand impersonation targeting the cryptocurrency price‑tracking service coingecko. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high likelihood of malicious intent. VirusTotal reports that 12 of 95 scanned security vendors flagged the domain, and the site is listed on a single public security blocklist. PhishDestroy has also blocked the domain.

The evidence confirms a hostile infrastructure designed to mislead users into believing the site is associated with a legitimate brand, despite the lack of an SSL layer. Uncertainty remains around the exact content served before the takedown, as the site is currently offline and no visual inspection was performed. Defenders should continue to block the domain at perimeter controls, update URL filtering and host‑based intrusion prevention systems with the observed IP and name‑server information, and monitor for any resurgence of similar domains registered by the same registrar or hosted within the same ASN. Regular review of threat‑intel feeds for additional indicators of compromise related to this infrastructure is recommended.