secure-eng-kucoin[.]framer[.]ai

Analysis of the domain secure-eng-kucoin.framer.ai, observed on 5 August 2026, classifies it as a credential‑phishing infrastructure. Registration data show the domain was created through Framer B.V., a registrar associated with the framer.ai sub‑domain space. The domain resolves to the single IPv4 address 31.43.160.6; no nameserver records were returned during lookup, indicating either misconfiguration or deliberate concealment of DNS infrastructure. Automated scanning on VirusTotal involved 91 antivirus and URL‑reputation engines; none reported a detection, but the absence of a flag does not constitute evidence of benign intent.

The domain is currently listed on one public security blocklist and has been actively blocked by the PhishDestroy sinkhole, confirming that threat‑intel feeds have identified it as malicious. The campaign remains active, with the risk level marked as “under investigation” by internal tracking. Observed indicators suggest that the operator is leveraging the framer.ai hosting platform to host credential‑phishing pages, likely targeting users of the KuCoin cryptocurrency exchange, as implied by the domain label.

Defensive recommendations include adding the domain and its resolving IP address to outbound and inbound firewall deny lists, updating URL filtering policies, and ensuring that endpoint protection solutions receive the latest threat‑intel feeds. Continuous monitoring of DNS queries for the domain and periodic re‑scanning with sandbox tools are advised to detect any changes in payload or hosting configuration. Organizations should also educate users about unsolicited login requests that reference KuCoin and encourage verification of URLs before credential entry.