kuccooienlegig[.]godaddysites[.]com

This domain, kuccooienlegig.godaddysites.com, was identified as a brand impersonation phishing site targeting KuCoin, a cryptocurrency exchange platform. The page title, "KÚCÔIN LÔGIN | BITCÔIN & CRYPTÔ," mimics the legitimate KuCoin login portal, likely designed to harvest user credentials or facilitate cryptocurrency theft. No explicit crypto drainer kit was detected in initial analysis, but the domain’s structure and content align with credential harvesting tactics commonly used in phishing campaigns. Analysis indicates the domain was registered through GoDaddy.com, LLC on November 18, 2013, though the subdomain’s malicious activity appears to be recent. It resolved to IP address 76.223.105.230, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) in the United States. The domain is flagged by 19 out of 95 security vendors on VirusTotal, and it appears on two security blocklists: PhishDestroy and PhishingDB. The SSL certificate, issued by Go Daddy Secure Certificate Authority - G2, does not mitigate the malicious intent, as phishing sites frequently use valid certificates to appear legitimate. As of the latest assessment, the domain has been taken offline, reducing immediate risk to users. However, residual threats remain, including potential reuse of the infrastructure or re-registration of similar domains. Organizations and users are advised to monitor for related phishing attempts, particularly those impersonating KuCoin or other cryptocurrency platforms. Blocking the domain and associated IP at the network level is recommended for proactive defense, alongside user education on recognizing brand impersonation tactics in cryptocurrency-related phishing.