ouyi[.]red

The domain ouyi.red has been identified as engaging in credential harvesting phishing campaigns and is currently under investigation with an active status. There is no confirmed brand impersonation linked to this domain at this time.

According to available intelligence, ouyi.red was registered through Dynadot Inc on October 2, 2025. The domain uses a Let's Encrypt SSL certificate and resolves to the IP address 54.215.31.113. VirusTotal analysis shows 0 detections among 95 vendor engines, indicating that it has not yet been flagged by major antivirus tools. The domain currently has no blocklist entries or established trust scores.

Given the active status and the potential for credential theft, users and organizations are advised to exercise caution when interacting with this domain. It is recommended to monitor network traffic for connections to 54.215.31.113 and to employ email filtering rules to block messages containing ouyi.red links. Security teams should update threat intelligence feeds regularly as the investigation progresses and consider preventive measures to mitigate exposure to this credential harvesting threat.