kucoicnlogmnus[.]godaddysites[.]com

Analysis of kucoicnlogmnus.godaddysites.com indicates a high-risk brand impersonation campaign targeting KuCoin, a well-known cryptocurrency exchange. The domain, registered on November 18, 2013, is hosted on infrastructure associated with AWS Global Accelerator (IP 13.248.243.5, located in Canada) and utilizes GoDaddy Website Builder alongside RequireJS and HSTS technologies. The page title, 'Kucoin Loℊin | Loℊ In Kucoin,' explicitly mimics KuCoin’s login portal, employing visually deceptive character substitutions (e.g., 'ℊ' for 'g') to evade casual detection. Security assessments reinforce the malicious classification: Scamadviser assigns a trust score of 1/100, Gridinsoft rates it 0/100, and PhishDestroy has already blocked the domain. While 18 of 91 security vendors on VirusTotal flag the domain, the absence of broader blocklist adoption suggests it may still evade some automated defenses. Infrastructure analysis reveals the domain uses GoDaddy’s nameservers (cns1.secureserver.net, cns2.secureserver.net) and a GoDaddy-issued SSL certificate, which, while valid, does not mitigate the underlying threat. The extended registration period (over a decade) is atypical for phishing domains but may reflect domain squatting or repurposing of an older, previously benign asset. Defenders should treat this domain as actively malicious and prioritize blocking it at the DNS, IP, and certificate authority levels. Organizations are advised to monitor for credential harvesting attempts linked to this infrastructure, particularly those targeting KuCoin users. The exact content and functionality of the site remain unconfirmed, but the combination of brand impersonation, low trust scores, and security vendor detections provides sufficient evidence for immediate mitigation.