interests-usdai[.]com

This domain, interests-usdai.com, is flagged as an active high-risk phishing threat targeting cryptocurrency users. Registered on April 22, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, the domain currently resolves to 172.67.210.188, a Cloudflare-hosted IP address located in Canada. Infrastructure analysis reveals the use of Cloudflare nameservers (paityn.ns.cloudflare.com and thomas.ns.cloudflare.com) and a Let's Encrypt SSL certificate (E7), which are common among both legitimate and malicious domains but do not mitigate the risk in this case. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and is referenced in at least one AlienVault OTX threat intelligence pulse. A VirusTotal scan shows one security vendor flagging the domain, though this low detection rate may reflect limited visibility rather than safety. The HTTP response code is 403 (Forbidden), and the page title reads 'Just a moment...', a behavior often associated with Cloudflare's anti-bot protection or intermediary pages used in phishing campaigns to filter traffic before redirecting victims to malicious content. Defenders should treat this domain as actively hostile. The combination of cryptocurrency-related naming ('usdai'), recent registration, and presence on multiple blocklists strongly suggests an intent to impersonate legitimate wallet services or DeFi platforms. The use of Cloudflare may obscure further analysis, but the domain's inclusion in threat intelligence feeds and its association with known phishing infrastructure warrant immediate blocking. Network security teams should monitor for connections to 172.67.210.188 or related domains and investigate any user reports of interaction with interests-usdai.com. Given the high-risk classification, assume any engagement with this domain could lead to credential theft or financial loss.