kucoinhdl[.]nilcat[.]cn

This domain, kucoinhdl.nilcat.cn, is flagged as a brand impersonation threat specifically targeting KuCoin, a major cryptocurrency exchange. The site replicates KuCoin’s branding, including its page title and visual design, to deceive users into entering sensitive account credentials or interacting with malicious smart contracts. Such impersonation attacks often lead to unauthorized access, fund theft, or deployment of crypto drainers, which silently siphon digital assets from connected wallets. Users who fall victim to these schemes typically face irreversible financial losses, as blockchain transactions are immutable and difficult to trace or recover. Analysis indicates the domain was registered on March 14, 2026, through 邦宁数字技术股份有限公司, a registrar based in China. Infrastructure analysis reveals the domain resolves to IP address 180.97.215.93, hosted on AS4134 (CHINANET-BACKBONE) within China. Security vendor assessments on VirusTotal show 20 out of 95 engines flagging the domain as malicious, while it appears on at least one security blocklist. The domain was secured with a Let’s Encrypt SSL certificate (R13), a common tactic to lend a false sense of legitimacy to phishing sites. Despite its current offline status, the domain’s infrastructure and registration details suggest it was actively used in a coordinated campaign to exploit KuCoin’s user base. Users who visited kucoinhdl.nilcat.cn or entered credentials on the site should immediately take corrective action. First, revoke any active sessions or connected wallet authorizations linked to the exchange. Reset passwords for KuCoin and any other accounts where the same credentials may have been reused. Enable multi-factor authentication (MFA) using an authenticator app or hardware key, avoiding SMS-based verification due to SIM-swapping risks. Monitor account activity for unauthorized transactions and report suspicious behavior to KuCoin’s official support channels. If a crypto wallet was connected, consider transferring assets to a new wallet and auditing all recent transactions for signs of compromise. Given the elevated risk of credential theft, affected users should also scan their devices for malware or keyloggers that may have captured additional sensitive data.