cnoyi[.]life

PhishDestroy identifies the newly registered domain cnoyi.life as an active fake banking login phishing threat targeting unsuspecting users under investigation for credential harvesting activities. This domain is currently propagating deceptive login pages mimicking legitimate banking portals to steal user credentials and financial data. Despite zero detections across VirusTotal's 95-vendor network, the threat remains active and under scrutiny with no definitive resolution. This domain was flagged by 3 of 95 VirusTotal vendors and registered through Dynadot Inc on October 03, 2025. cnoyi.life resolves to IP 54.215.31.113, utilizes a Let's Encrypt SSL certificate, and operates with a newly established trust profile, having no history in publicly available blocklists. The domain's age of mere days and absence of reputation metrics amplify its risk profile, making it a prime candidate for exploitation in phishing campaigns. Due to the evolving nature of this threat, users are advised to avoid engaging with cnoyi.life and report any encounters to their security teams. Organizations should block the associated IP 54.215.31.113 and monitor network traffic for anomalous login requests. Immediate updates to browser security lists and endpoint protection solutions are recommended to mitigate potential exposure. Ongoing monitoring for new phishing campaigns leveraging this domain is critical for timely intervention.