Three-IP Hosting Block Masks KuCoin Fake and Wallet-Stealer Kit
A tiny AS214351 hosting block run by Femo IT Solutions splits its three IPs between a KuCoin-impersonating certificate and a scam-baiting domain front, while backing a modular crimeware toolkit that drains browser and Exodus wallet data and hijacks clipboards. Disposable Let's Encrypt certs and lightweight PHP panels point to a financially motivated operation optimized for rapid infrastructure turnover.
Three IP addresses — 62.60.226.159, 196.251.107.104, and 196.251.107.130 — sit on a single small hosting block registered to Femo It Solutions Limited under AS214351, and two of them are dressed in freshly minted TLS certificates that have nothing to do with each other's cover story. One serves a Let's Encrypt certificate for "kucoin.sh," complete with subject alternative names for security.kucoin.sh and www.kucoin.sh — a crypto-exchange lookalike.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read