kouyiocri[.]ru

PhishDestroy identifies kouyiocri.ru as an active crypto drainer domain. This recently registered malicious site poses an elevated risk to cryptocurrency users by attempting to deceive victims into connecting wallets or transferring funds.

The domain was flagged by 4 of 95 VirusTotal security vendors, demonstrating early detection of its malicious nature. Registered through R01-RU on March 28, 2026, the domain resolves to IP address 103.136.43.130 and operates with a valid Let's Encrypt SSL certificate, which threat actors often use to appear legitimate. With only 4 detections on VirusTotal and no additional blocklist data available, this domain remains under the radar while actively propagating.

This domain is currently active and represents a concrete threat to cryptocurrency users. Users are strongly advised to avoid interacting with kouyiocri.ru and verify any related URLs or claims using PhishDestroy’s real-time safety lookup. Security teams should consider blocking the domain and IP address 103.136.43.130 at the network level. Always inspect SSL certificates for anomalies and cross-reference domains with established threat intelligence feeds. For further protection, enable wallet connection warnings and use hardware wallets for high-value transactions.