unlockai[.]to

This domain, unlockai.to, is identified as a cryptocurrency credential phishing site designed to harvest wallet credentials, including private keys and recovery phrases. The page title, "UnlockAI Access," suggests an attempt to impersonate legitimate AI-driven platforms, likely targeting users of cryptocurrency wallets or decentralized applications. Current analysis confirms the domain is offline, but prior activity indicates a focused effort to deceive users into disclosing sensitive authentication details. Infrastructure analysis reveals the domain was registered through NAMECHEAP on April 04, 2026, an unusually forward-dated creation that may indicate an attempt to evade detection or bypass domain age filters. It resolves to the IP address 35.157.26.135 and is associated with a Let's Encrypt SSL certificate, which provides a veneer of legitimacy but is commonly exploited in phishing operations. The domain has been flagged by 4 of 95 security vendors on VirusTotal and appears on three independent security blocklists. Additional defensive measures include blocking by MetaMask, PhishDestroy, and SEAL, further corroborating its malicious intent. A Gridinsoft trust score of 0 out of 100 underscores the domain's high-risk classification. At present, unlockai.to is offline, though the infrastructure remains registered and could be reactivated. Organizations and individuals are advised to maintain blocklist entries for this domain and its associated IP address. Users who may have interacted with the site should immediately revoke any exposed wallet permissions, transfer assets to a new secure wallet, and monitor for unauthorized transactions. Security teams should treat this domain as part of a broader phishing campaign targeting cryptocurrency users and adjust detection rules accordingly.