cnoyi[.]org

This domain cnoyi.org is flagged for brand impersonation targeting OKX with a page title that includes the specific referral code 37602380 and the text Earn rewards when you get started on OKX. Registration records show creation on April 27 2026 via Dynadot Inc along with nameservers ns1.dyna-ns.net and ns2.dyna-ns.net. The domain resolves to IP address 54.215.31.113 located in AWS EC2 us-west-1 within the United States. Infrastructure analysis reveals a 302 HTTP status code and an SSL certificate issued by Let's Encrypt under authority R13.

Detection data indicate the domain appears on one security blocklist, receives a VirusTotal score of 1 out of 95 vendors, and is listed in one AlienVault OTX threat pulse. Gridinsoft assigns a trust score of 0 out of 100. The domain remains active with a high risk classification and continues to be blocked by PhishDestroy. The combination of recent registration, specific brand references in the title, and low but present detection counts points to deliberate impersonation rather than incidental overlap.

Uncertainties persist regarding the final landing content after the observed 302 redirect and any additional subdomains or associated infrastructure that may not yet appear in public records. No direct evidence confirms the exact kit or payload beyond the reported title strings. Analysis indicates the domain was registered well before the current July 12 2026 report date so timing alone does not establish novelty.

Defenders should incorporate the exact IP 54.215.31.113 and nameserver pair into existing block rules while monitoring for similar OKX-themed titles containing referral codes. Cross-checking against the single known blocklist entry and OTX pulse allows efficient expansion of watchlists without reliance on unconfirmed indicators. Regular verification of Dynadot-registered domains matching the cnoyi.org pattern remains advisable given the registrar association documented here.