usdai-rewards[.]com

This domain, usdai-rewards.com, is flagged as an active phishing threat targeting cryptocurrency users. Registered on April 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, the site currently resolves to 172.67.223.175, a Cloudflare IP address located in Canada. Infrastructure analysis reveals Cloudflare nameservers (jonah.ns.cloudflare.com and keyla.ns.cloudflare.com) and a Let's Encrypt SSL certificate (serial E7), which are commonly used to mask malicious infrastructure while providing HTTPS legitimacy. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, indicating prior detection by multiple threat intelligence sources. AlienVault OTX records its presence in one threat intelligence pulse, though VirusTotal currently shows zero detections out of 95 engines. The HTTP response code is 403, suggesting access restrictions or a temporary cloaking mechanism, while the page title 'Just a moment...' is consistent with Cloudflare's interstitial page or a phishing kit attempting to evade automated scanners. Defenders should treat this domain as high-risk due to its recent registration, association with cryptocurrency-themed phishing, and Cloudflare-hosted infrastructure. The lack of VirusTotal detections does not indicate safety, as phishing kits often rotate domains and IPs to evade detection. Network-level blocking at the IP (172.67.223.175) and domain level is recommended, alongside monitoring for related subdomains or newly registered lookalike domains. Security teams should correlate this domain with any observed credential harvesting or wallet-draining incidents, particularly those involving fake reward schemes.