manage-kucoiin-en-us[.]framer[.]ai

The domain manage-kucoiin-en-us.framer.ai is flagged as an active high‑risk phishing infrastructure as of 24 July 2026. Registration data shows the domain was created through the registrar Framer B.V., indicating that the attacker leveraged a legitimate web‑hosting service to obtain a sub‑domain under the framer.ai namespace. DNS resolution points to the single IPv4 address 31.43.160.6; no additional A, AAAA, or CNAME records are publicly listed, and the authoritative nameserver information is unavailable (NS_NOT_FOUND). The IP address is currently hosted in an undisclosed network and does not appear in public ASN or geolocation data within the supplied intelligence.

Detection engines on VirusTotal have flagged the domain in eight out of ninety‑one scanners, demonstrating that multiple security products have observed malicious behavior associated with the host. The domain also appears on one external blocklist and has been added to the PhishDestroy blacklist, confirming that at least one community‑driven mitigation service has taken action against it. No further evidence such as SSL certificate details, HTTP response codes, page title, or Safe Browsing verdicts is present in the current dataset, so the exact content served by the site remains unknown. Given the confirmed resolution to a dedicated IP, the presence on multiple vendor blocklists, and the active status, defenders should treat any traffic to this domain as malicious.

Recommended actions include adding the domain and its resolving IP to network‑level deny lists, updating endpoint protection signatures, and monitoring DNS logs for any look‑ups. Where possible, sinkholing the IP or deploying a DNS‑sinkhole record can disrupt command‑and‑control attempts. Continuous re‑assessment is advised, as further analysis of the HTTP payload or TLS certificate could reveal additional indicators of compromise.