usdai-tge[.]org

This domain, usdai-tge.org, is flagged as a cryptocurrency-focused phishing site designed to impersonate a token generation event (TGE) or initial coin offering (ICO). Analysis indicates the infrastructure mimics legitimate cryptocurrency project launches, likely targeting users of decentralized finance (DeFi) platforms or investors seeking early-stage token allocations. No specific drainer kit signatures were identified in available telemetry, but the domain follows patterns consistent with fake token sale scams, including the use of terms like 'tge' to lend false credibility. The site may harvest wallet credentials, private keys, or direct users to fraudulent smart contracts under the guise of a legitimate token distribution. Infrastructure analysis reveals the following technical indicators: the domain was registered on April 09, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with phishing and abuse. It resolves to the IP address 104.21.8.157, which is part of a content delivery network (CDN) range known to host both legitimate and malicious content. VirusTotal reports 2 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The domain has a trust score of 0/100, and no detections were recorded in Google Safe Browsing (GSB) at the time of analysis. AlienVault OTX records the domain in a single threat intelligence pulse, suggesting limited but confirmed malicious activity. As of the latest verification, usdai-tge.org has been taken offline, likely in response to abuse reports or automated takedown mechanisms. The domain is blocked by at least one security provider, and its registration details remain publicly accessible, though no active content is served. Despite its offline status, residual risk persists due to the potential for re-activation or migration to similar domains. Users who interacted with the site should assume credential exposure and monitor associated wallets for unauthorized transactions. Organizations are advised to maintain blocklist entries for this domain and its resolving IP, while cryptocurrency platforms should flag it in transaction monitoring systems to prevent further abuse.