kuqqxoiinlgin[.]godaddysites[.]com

This domain, kuqqxoiinlgin.godaddysites.com, is flagged for brand impersonation targeting KuCoin, a cryptocurrency exchange platform. The page title, "Loℊin | Loℊ In Kucoin," employs homoglyph substitution (Unicode character U+213A) to mimic legitimate login portals, a common tactic in credential harvesting campaigns. No explicit drainer kit signatures were identified, but the domain structure and content align with phishing infrastructure designed to deceive users into submitting sensitive credentials.

Infrastructure analysis reveals the domain resolves to IP address 76.223.105.230, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The domain was registered on November 18, 2013, through GoDaddy.com, LLC, though recent activity suggests it was repurposed for malicious use. The SSL certificate, issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority - G2, provides a veneer of legitimacy. Detection metrics indicate 19 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on 2 independent security blocklists. Google Safe Browsing (GSB) status was not explicitly provided, but the domain has been proactively blocked by at least two threat intelligence feeds.

As of the latest assessment, kuqqxoiinlgin.godaddysites.com has been taken offline, likely due to hosting provider intervention or registrar enforcement. However, residual risk persists due to the domain's historical registration and potential for reactivation. Organizations are advised to update web filtering rules to block the domain and its associated IP, monitor for homoglyph variations (e.g., Unicode U+213A), and alert users to the impersonation tactic. Network defenders should correlate this domain with other KuCoin-themed phishing campaigns to identify broader patterns in attacker infrastructure.