kuconilogi-us[.]godaddysites[.]com

This domain is flagged for elevated risk due to brand impersonation targeting cryptocurrency users. Analysis indicates the site mimics a legitimate login portal for a digital asset exchange, specifically designed to harvest credentials from unsuspecting victims. The threat type is classified as credential theft through brand spoofing, with a focus on cryptocurrency-related fraud. Infrastructure analysis reveals the domain kuconilogi-us.godaddysites.com was registered through GoDaddy.com, LLC on November 18, 2013, though recent malicious activity suggests compromise or repurposing. It resolves to IP address 76.223.105.230, hosted on Amazon.com, Inc. infrastructure (AS16509). The SSL certificate is issued by GoDaddy.com, Inc., which may lend a false sense of legitimacy. The domain appears on two security blocklists and is flagged by 19 out of 95 security vendors on VirusTotal. The page title, KÚCÔIN LÔGIN | BITCÔIN & CRYPTÔ EXCHANGE, uses homoglyphs to closely resemble a well-known cryptocurrency platform, increasing the likelihood of deception. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP address across network security controls. Organizations should deploy email and web filtering rules to prevent delivery or access to the domain. End users should be educated on recognizing homoglyph attacks and verifying domain authenticity before entering credentials. Security teams are advised to monitor for credential reuse attempts, particularly targeting cryptocurrency wallets or exchange accounts. If credentials were entered on this site, immediate password resets and multi-factor authentication enforcement are recommended for all associated accounts.