app[.]teemi[.]ai

PhishDestroy identifies app.teemi.ai as a recently activated cryptocurrency asset-draining phishing domain designed to trick visitors into connecting wallets and authorize malicious token transfers.

Technical indicators include a Let’s Encrypt SSL certificate, registration through GoDaddy on March 26, 2025, and a single IPv4 endpoint at 18.141.228.170. VirusTotal currently shows 0 detections out of 95 engines, indicating the domain has not yet been widely blacklisted. The combination of a new creation date, low detection coverage, and the specific hosting region suggests an opportunistic launch aimed at early victims.

Users who accessed app.teemi.ai should immediately revoke any wallet connections granted on the site, transfer remaining assets to a separate, clean wallet, and run a malware scan on the device used. Do not re-enter seed phrases or private keys anywhere on the domain. Report the incident to PhishDestroy for updated IOCs and to help block future redirections.