kuqqwoiinlgin[.]godaddysites[.]com

Analysis of the domain kuqqwoiinlgin.godaddysites.com indicates active brand impersonation targeting KuCoin, a cryptocurrency exchange platform. The site is hosted on infrastructure associated with GoDaddy Website Builder and resolves to the IP address 76.223.105.230, located within Amazon.com, Inc.'s AS16509 network in the United States. The domain is registered through GoDaddy.com, LLC, with creation dating back to November 18, 2013, though the subdomain itself appears to have been recently repurposed for malicious activity. The page title, 'Loℊin | Loℊ In Kucoin,' employs homoglyph substitution (the use of a Unicode character resembling a lowercase 'g') to evade detection and mimic the legitimate KuCoin login portal. This technique is commonly observed in phishing campaigns designed to harvest user credentials.

The domain is currently flagged by one security blocklist, specifically PhishDestroy, and holds a Gridinsoft trust score of 0/100, reflecting a high-risk classification. Sixteen out of ninety-five security vendors on VirusTotal have detected the domain as malicious, further corroborating its fraudulent nature. The SSL certificate is issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority - G2, a legitimate but frequently abused certificate authority in phishing operations. The domain returns an HTTP 200 status, confirming its active status as of the report date. Technologies detected include RequireJS and HTTP Strict Transport Security (HSTS), which may be leveraged to enhance the site's perceived legitimacy or to enforce encrypted connections for credential theft.

Defenders are advised to block the domain and its resolving IP (76.223.105.230) at the network level. Security teams should monitor for homoglyph-based impersonation tactics in similar campaigns, particularly those targeting cryptocurrency platforms.