kucoin[.]xyzbuy[.]net

Analysis of the domain kucoin.xyzbuy.net indicates active brand impersonation targeting KuCoin, a cryptocurrency exchange. The domain was registered on February 13, 2023, through HOSTINGER operations, UAB, and remains operational as of July 12, 2026. Infrastructure analysis reveals the domain resolves to an IPv6 address (2a02:4780:3:706:0:1404:701e:10) hosted under AS47583 (Hostinger International Limited) in Singapore. Nameservers are configured as ns1.dns-parking.com and ns2.dns-parking.com, a pattern commonly observed in low-cost or disposable hosting setups. The page title, 'Unlock Limitless Possibilities with KuCoin - Your Gateway to a Diverse Crypto Universe,' explicitly references KuCoin, confirming the intent to impersonate the brand. The domain has been flagged by one security blocklist and is blocked by PhishDestroy. A Let's Encrypt SSL certificate (R13) is present, providing HTTPS encryption, which may increase the perceived legitimacy of the site to potential victims. Technologies detected include LiteSpeed and Hostinger, with HTTP/3 support, suggesting a modern but potentially low-cost hosting environment. VirusTotal reports 15 of 91 security vendors flagging the domain, though the specific nature of detections (e.g., phishing, malicious content, or brand abuse) is not detailed in available intelligence. The Gridinsoft trust score of 0/100 further corroborates the high-risk classification. No evidence of a phishing kit or specific scam mechanics (e.g., credential harvesting, crypto drainer) has been confirmed at this stage, though the brand impersonation and hosting characteristics align with known phishing infrastructure. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where cryptocurrency-related activity occurs. Monitoring for additional domains registered under similar patterns (e.g., same registrar, nameservers, or hosting provider) may help identify related threats.