kucoinrea[.]nilcat[.]cn

This domain, kucoinrea.nilcat.cn, poses a brand impersonation threat designed to deceive users of the cryptocurrency exchange KuCoin. The site mimics the legitimate platform’s appearance, including its page title, to trick visitors into entering sensitive information such as login credentials, wallet details, or two-factor authentication codes. Such impersonation attacks are commonly used to facilitate unauthorized account access, fund theft, or further malicious activity like crypto drainers, where victims unknowingly authorize transactions to attacker-controlled wallets. Analysis indicates this domain was registered on March 14, 2026, through 邦宁数字技术股份有限公司, a registrar associated with other suspicious infrastructure. It resolves to the IP address 180.97.215.93, located in China under AS4134 (CHINANET-BACKBONE). At the time of detection, 19 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appeared on one security blocklist. The site used a Let’s Encrypt SSL certificate (R13), which, while providing encryption, does not validate legitimacy. The domain has since been taken offline, but similar threats may reappear under different names or infrastructure. If you visited kucoinrea.nilcat.cn or entered any credentials, take immediate action. First, revoke any active sessions on the legitimate KuCoin platform and change your password using a secure device. Enable multi-factor authentication if not already active. Monitor your account for unauthorized transactions and report suspicious activity to KuCoin’s support team. If you connected a wallet or authorized any transactions, assume compromise and transfer remaining funds to a new, secure wallet. Check connected devices for malware, as impersonation sites often distribute additional payloads. Finally, report the domain to security teams or threat intelligence platforms to aid in broader mitigation efforts.