kucoinoxc[.]nilcat[.]cn

This domain, kucoinoxc.nilcat.cn, poses a direct threat as a brand impersonation site targeting KuCoin, a major cryptocurrency exchange. The site is designed to deceive users into entering login credentials or wallet details, likely facilitating unauthorized access to accounts or direct crypto asset theft. The page title explicitly replicates KuCoin’s branding, increasing the likelihood of successful social engineering attacks against users familiar with the legitimate platform.

Analysis of technical indicators reveals significant red flags. The domain was registered on March 14, 2026, through 邦宁数字技术股份有限公司, and resolves to the IP address 180.97.215.93, located within AS4134 (CHINANET-BACKBONE). It is currently flagged by 19 out of 95 security vendors on VirusTotal, and appears on at least one security blocklist. The domain’s SSL certificate, issued by Let’s Encrypt (R13), provides encryption but does not mitigate the underlying malicious intent. Infrastructure analysis indicates the site was operational long enough to pose a credible threat before being taken offline.

Users who visited kucoinoxc.nilcat.cn or entered credentials on the site should take immediate action. First, revoke any active sessions on the legitimate KuCoin platform and reset passwords using multi-factor authentication (MFA). Monitor all linked accounts, including email and connected wallets, for unauthorized transactions. If cryptocurrency was transferred or wallet details were shared, consider moving assets to a new, secure wallet. Report the incident to KuCoin’s official security team and relevant authorities to assist in tracking the threat. Future vigilance is critical, as similar domains may emerge using comparable naming conventions or infrastructure.