kucoini55[.]com

On July 25, 2026 the domain kucoini55.com was identified as a brand‑impersonation infrastructure targeting the cryptocurrency exchange KuCoin. The site is hosted on IP address 103.87.242.102, which resolves to Hong Kong and is announced by ASN 135581 (ONL‑HK). SSL analysis shows the certificate labeled R10, indicating a possibly self‑signed or low‑trust certificate. VirusTotal scans returned 10 positive detections out of 93 security vendors, confirming that multiple engines consider the domain malicious.

Independent reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reinforcing the low‑trust assessment. The page title returned by HTTP requests is “Crypto Exchange,” matching the declared scam type of a crypto‑related scam. Registration data reveals the domain was created on 31 March 2025 through Gname.com Pte. Ltd., a registrar commonly used for disposable or malicious registrations. The domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy, indicating that at least one proactive security service has taken action.

Current operational status is offline, suggesting that the malicious content has been removed or the server has been taken down. While the page title and brand target are known, the exact content, login flow, or payload delivered by the site have not been publicly disclosed, leaving a gap in full behavioral analysis. Defenders should continue to block the IP 103.87.242.102 and the domain kucoini55.com at network and DNS layers, update intrusion‑prevention signatures with the observed VirusTotal detections, and monitor for any re‑registration attempts or similar domains leveraging the KuCoin brand. Ongoing observation of the registrar Gname.com Pte. Ltd. for rapid domain issuance may help pre‑empt future impersonation campaigns.