river-we[.]cyou

This domain, river-we.cyou, is identified as a crypto drainer phishing site targeting users of the RIVER wallet service. The domain is currently offline but was actively used to impersonate legitimate cryptocurrency wallet interfaces, tricking victims into connecting wallets and authorizing malicious transactions that drain funds. No specific brand impersonation beyond the RIVER name was observed, but the threat type aligns with common cryptocurrency theft tactics. Analysis indicates the domain was flagged by 9 of 95 security vendors on VirusTotal, a notably high detection rate for a recently created phishing resource. Registered on October 18, 2025, through Gname.com Pte. Ltd., the domain resolved to the IPv6 address 2606:4700:3033::ac43:d1e3, hosted on infrastructure associated with AS13335 (Cloudflare, Inc.). The domain appears on two security blocklists and lacks an SSL certificate, a common red flag for fraudulent sites. The page title, 'RIVER,' further confirms its intent to mimic legitimate wallet services. The domain is currently offline, but its infrastructure and registration details suggest it may resurface or be repurposed for similar attacks. Organizations and individuals are advised to block the domain at the DNS level and monitor for any re-emergence. Users who interacted with this domain should revoke any connected wallet authorizations and audit transaction histories for unauthorized activity. Security teams should treat this domain as high-risk and include it in threat intelligence feeds for proactive defense.