kucoinmnz[.]nilcat[.]cn

The domain kucoinmnz.nilcat.cn has been identified as a confirmed phishing site engaged in brand impersonation targeting KuCoin, a cryptocurrency exchange platform. Analysis indicates this domain was designed to mimic the legitimate KuCoin interface, likely to deceive users into disclosing sensitive credentials or transferring digital assets under false pretenses. As of the latest verification, the domain has been taken offline, though prior activity suggests it was actively used for malicious purposes. Infrastructure analysis reveals the domain was registered on March 14, 2026, through 邦宁数字技术股份有限公司, a registrar associated with elevated-risk domains. It resolved to the IP address 180.97.215.93, located within the CHINANET-BACKBONE (AS4134) network in China. The domain was flagged by 20 of 95 security vendors on VirusTotal, indicating a high likelihood of malicious intent. Additionally, it appeared on one security blocklist and was issued an SSL certificate by Let's Encrypt (R13), a common tactic to lend superficial legitimacy to phishing infrastructure. The page title was explicitly set to 'KuCoin,' further confirming its intent to impersonate the legitimate platform. Current status confirms the domain is offline, though residual risk remains due to the potential for re-registration or reuse of associated infrastructure. Organizations and users are advised to block the domain and its resolved IP (180.97.215.93) at the network level to prevent accidental exposure. Cryptocurrency platforms and financial institutions should monitor for credential reuse or transaction anomalies linked to this domain. Users who may have interacted with the site should immediately revoke active sessions, reset passwords, and enable multi-factor authentication on all critical accounts. Proactive threat hunting for related indicators, such as the registrar or SSL certificate issuer, is recommended to identify potential secondary campaigns.