info-kucoin-cd[.]framer[.]ai

On July 24, 2026 the domain info-kucoin-cd.framer.ai was observed as offline but retains several technical artifacts linking it to a cryptocurrency impersonation campaign targeting KuCoin users. The site served a page whose title read “Log In | Kucoin (Official Site)® - Sign In to Your Account™”, indicating an attempt to mimic the legitimate KuCoin login portal. DNS resolution points to the IPv4 address 31.43.161.6, which belongs to Amazon’s AS16509 network and is geolocated in the Netherlands. The domain was registered on February 28, 2026 through CSC Corporate Domains, Inc., and its authoritative name servers are ns-1902.awsdns-45.co.uk, ns-635.awsdns-15.net, ns-1198.awsdns-21.org, and a fourth unnamed server.

The TLS certificate is issued by Let’s Encrypt (identifier E8) and the site advertised HSTS and HTTP/3 support, while the underlying web stack includes Framer Sites and React. A request to the root URL returned HTTP 404, suggesting the malicious landing page may have been removed or is otherwise inaccessible. Threat intelligence aggregators have flagged the domain on one blocklist, and PhishDestroy has recorded it as blocked. VirusTotal analysis shows 16 of 93 security vendors label the domain as malicious, reinforcing the suspicion of a crypto‑related scam.

The evidence confirms that the domain was deliberately crafted to impersonate KuCoin and to harvest credentials or funds. While the site is currently offline, defenders should continue to monitor the associated IP address and AWS name servers for re‑activation, enforce DNS‑based blocking for the domain and its IP, and update endpoint protection signatures with the observed indicator set. Additional investigation is warranted to determine whether any credential harvesting occurred before takedown and to assess potential reuse of the infrastructure in future campaigns.