ouyifloki[.]top

Analysis of www.ouyifloki.top indicates the domain is actively leveraged for a generic phishing campaign. The domain was registered on May 23, 2026 through NameSilo, LLC and is currently resolved to the IP address 104.21.1.193, which is hosted behind Cloudflare as reflected by the authoritative nameservers celine.ns.cloudflare.com and clark.ns.cloudflare.com. VirusTotal records show that six of ninety‑one scanning engines have flagged the domain for malicious activity, suggesting a moderate level of detection across independent security products. The domain appears on a single external blocklist and has been explicitly blocked by the PhishDestroy service, confirming that at least one dedicated anti‑phishing feed considers it hazardous.

No additional public intelligence such as page title, SSL certificate details, HTTP response codes, or observed phishing kit signatures is currently available, so the exact content and targeted brand remain unknown. This lack of observable payload information limits attribution but does not diminish the risk posed by the infrastructure. Defenders should immediately add www.ouyifloki.top to network‑level deny lists and DNS filtering policies, and consider blocking the associated IP 104.21.1.193 to curtail any outbound or inbound traffic.

Continuous monitoring of DNS queries for similarly named domains created after May 2026, as well as the Cloudflare nameserver set, is advised to detect potential copycat operations. Organizations employing email security gateways should ensure that URLs pointing to this domain are treated as malicious, and incident response teams should be prepared to investigate any credential submissions that may be routed through the site. Ongoing collection of page‑level artifacts, SSL metadata, and user‑reporting will be necessary to refine the threat profile and to validate whether the campaign targets specific brands or employs a broader credential‑harvesting strategy.