niyuve[.]cuqico[.]com

PhishDestroy identifies niyuve.cuqico.com as an active crypto drainer phishing domain impersonating a generic 'Web App' interface. The domain remains operational as of the latest scan and continues to pose a direct threat to unsuspecting users who may interact with it under false pretenses. While the specific cryptocurrency platform or service being impersonated has not been confirmed, the presence of a crypto drainer payload cannot be ruled out given the domain’s configuration and observed behavior patterns. Users are advised to treat this domain as hostile until further forensic analysis is completed. This domain was flagged by 1 of 95 VirusTotal vendors, indicating a lack of widespread detection despite its active status. It was registered through CNOBIN INFORMATION TECHNOLOGY LIMITED, resolves to IP address 2.26.50.28, and was created on April 11, 2026. The domain operates with a valid Let's Encrypt SSL certificate, which may contribute to user trust. Notably, there are currently no public blocklist entries associated with this domain, and its trust scores remain unassessed across major threat intelligence platforms. The absence of detections suggests this campaign may be newly deployed or leveraging evasion tactics to bypass initial screening mechanisms. The current status of niyuve.cuqico.com remains active, with no signs of takedown or mitigation as of this report. Given the high-risk nature of crypto drainer phishing campaigns, which often result in irreversible financial loss, immediate defensive action is recommended. Users should avoid accessing this domain entirely and report any encounters. Organizations are urged to implement network-level blocking for the domain and associated IP (2.26.50.28) to prevent accidental exposure. Additionally, users who may have already interacted with this domain should revoke any connected wallet permissions, transfer remaining assets to a secure wallet, and perform a full security audit. Continuous monitoring for similar domains is advised, as threat actors frequently rotate infrastructure to sustain campaign longevity. PhishDestroy will provide updates as new intelligence emerges.