ouyi[.]city

This domain, ouyi.city, is identified as a brand impersonation phishing site designed to deceive users of the cryptocurrency exchange OKX. The page mimics legitimate OKX promotional content, displaying a referral code (54084913) and offering fraudulent rewards to lure victims into disclosing credentials or transferring funds. The use of WebAssembly and React suggests an attempt to create a dynamic, convincing interface, while the inclusion of analytics and tracking technologies (Naver Analytics, Google Tag Manager) indicates an effort to monitor victim interactions and optimize the phishing campaign’s effectiveness. The domain’s infrastructure is further supported by Alibaba Cloud Object Storage Service, a common choice for hosting malicious content due to its scalability and low cost. Analysis of ouyi.city reveals multiple technical indicators confirming its malicious nature. The domain was registered on February 03, 2023, through Alibaba Cloud Computing Ltd. d/b/a HiChina, a registrar frequently associated with phishing and fraudulent domains. VirusTotal reports that 3 out of 95 security vendors flag this domain as malicious, a modest but notable detection rate that aligns with its offline status. Additionally, the domain appears on one security blocklist, and its resolution to the IP address 104.21.84.194—an address previously linked to other phishing campaigns—further corroborates its classification as a threat. The presence of technologies like ThreatMetrix and OneTrust, typically used for fraud prevention, may be an attempt to evade automated detection systems by mimicking legitimate security practices. Users who visited ouyi.city should take immediate action to mitigate potential risks. If credentials or personal information were entered on the site, affected individuals should revoke access to any linked accounts, enable multi-factor authentication, and monitor for unauthorized transactions or account activity. Given the domain’s association with cryptocurrency, victims should also check connected wallets for signs of compromise, such as unexpected transfers or changes in permissions. The domain’s current offline status does not eliminate the risk, as threat actors may reactivate it or reuse its infrastructure for future campaigns. Organizations and individuals are advised to block the domain and its associated IP address (104.21.84.194) at the network level to prevent accidental exposure.