cnouyi[.]org

PhishDestroy identifies cnouyi.org as an active generic phishing domain posing as a fraudulent investment gateway designed to harvest cryptocurrency wallet credentials and private keys. This domain appears to deploy a drainer kit tailored to siphon digital assets under the guise of 'investment opportunities' or 'portfolio management tools.' No specific brand is directly mentioned in available telemetry, suggesting a generic financial-themed lure rather than a targeted impersonation. The threat actor behind this domain uses obfuscated JavaScript and fake transaction prompts to trick victims into connecting malicious wallet extensions or entering seed phrases.

This domain exhibits multiple red flags verified through forensic analysis. cnouyi.org was registered on December 18, 2025, through Dynadot Inc., just days ago. It resolves to IP 54.215.31.113 and leverages a legitimate SSL certificate from Let's Encrypt to appear trustworthy. However, VirusTotal analysis confirms only 1 out of 95 security vendors currently detect this threat, and it remains unflagged by Google Safe Browsing (GSB) as of the latest scan. The domain has not yet appeared on major blocklists, indicating a newly active campaign with low detection coverage.

As of current intelligence, cnouyi.org is flagged as 'active' with elevated risk. Immediate action is recommended: block this domain at network and endpoint levels, update browser and DNS blocklists, and warn users to avoid accessing financial services links from unsolicited emails or social media. While the current risk is elevated due to low detection, rapid response can mitigate potential victimization. However, the absence from major blocklists and fresh SSL issuance suggests the campaign may expand quickly. Users are advised to verify all financial websites via official channels and never enter wallet credentials on unofficial portals.