kucoinibvlosginie[.]godaddysites[.]com

This domain, kucoinibvlosginie.godaddysites.com, is flagged as a credential phishing site impersonating KuCoin, a cryptocurrency exchange platform. The page title, 'KuCoin: Log In | Sign In,' directly mimics the legitimate KuCoin login interface, indicating an intent to harvest user credentials. No drainer kit signatures were identified in initial analysis, though further forensic examination of the source code may be required to confirm the absence of automated fund-transfer mechanisms.

Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on November 18, 2013, though recent malicious activity suggests potential compromise or repurposing. It resolves to the IP address 76.223.105.230, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The SSL certificate is issued by Go Daddy Secure Certificate Authority - G2, a common certificate provider for both legitimate and malicious sites. Detection metrics indicate 18 out of 95 security vendors on VirusTotal flagged this domain as malicious, and it appears on one security blocklist. Google Safe Browsing status was not explicitly confirmed in available data.

As of the latest verification, the domain has been taken offline, likely following abuse reports or automated takedown processes. While the immediate threat is mitigated, residual risk remains due to potential credential reuse by victims. Organizations are advised to monitor for unauthorized access attempts using compromised credentials and implement multi-factor authentication (MFA) for all sensitive accounts. Historical WHOIS data and SSL certificate transparency logs may provide additional context for tracking related infrastructure.