koiicinglogn[.]godaddysites[.]com

The domain koiicinglogn.godaddysites.com was observed hosting a page titled “KÚCÔIN LÔGIN | KÚCÔIN trading platform”, explicitly referencing the KuCoin cryptocurrency exchange. The site is registered through GoDaddy.com, LLC and uses GoDaddy’s default nameservers cns1.secureserver.net and cns2.secureserver.net. DNS resolution points to 76.223.105.230, an Amazon Web Services IP address located in the United States and belonging to ASN 16509 (Amazon.com, Inc.). The TLS certificate presented is a Go Daddy Secure Certificate Authority – G2 certificate issued by GoDaddy.com, Inc., matching the hosting provider.

An HTTP request returns a 404 status, indicating the content is no longer available, and the domain is currently listed as offline. Despite the offline state, the domain appears on at least one public blocklist (PhishDestroy) and has been flagged by 13 of 95 VirusTotal scanners, reinforcing its malicious classification. The page title and the explicit mention of “KuCoin” confirm a brand‑impersonation campaign aimed at deceiving users of the KuCoin platform, likely to harvest credentials or facilitate a crypto‑related fraud. The registration date of 18 November 2013 shows the domain has existed for many years, but its recent activation aligns with the detection timestamp.

No additional technical artifacts such as malicious payloads, redirects, or JavaScript have been disclosed, leaving the exact attack vector uncertain. Defenders should update web filtering and DNS sinkhole policies to block resolution of this host, monitor for any traffic to the associated AWS IP range, and enforce multi‑factor authentication for KuCoin accounts. Threat intelligence feeds should incorporate the observed indicators – domain name, IP address, SSL fingerprint, and blocklist identifiers – to improve detection across endpoint and network sensors. Continuous re‑evaluation is advised in case the site is reinstated or reused in future campaigns.