drawnbe[.]cyou

This domain is flagged as a high-risk credential harvesting phishing threat. Analysis indicates drawnbe.cyou was designed to mimic legitimate login pages, tricking users into submitting sensitive credentials such as usernames, passwords, or financial details. The absence of an SSL certificate and the use of a known malicious IP address further confirm its intent to deceive and exfiltrate data without encryption or verification. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP 37.77.150.150, hosted in Russia under LLC Baxet, a provider frequently associated with malicious activity. Registered via Dynadot LLC on April 04, 2026, drawnbe.cyou has been flagged by 21 out of 95 security vendors on VirusTotal. It appears on three independent security blocklists and is actively blocked by multiple threat intelligence feeds. The domain currently holds an offline status, though historical activity suggests prior operational use in phishing campaigns. Mitigation steps include immediate blocking of the domain and its associated IP (37.77.150.150) at the network perimeter. Organizations should update endpoint protection rules to detect and prevent access to drawnbe.cyou and related infrastructure. Users who may have interacted with the domain should be instructed to reset credentials for any accounts accessed during the exposure window. Security teams are advised to monitor for indicators of compromise, including unusual authentication attempts or data exfiltration patterns linked to this IP or domain. Proactive threat hunting should focus on logs containing references to drawnbe.cyou or its resolved IP address.