portal-usdai[.]com

This domain, portal-usdai.com, operates as a crypto wallet drainer designed to steal digital assets from unsuspecting users. Crypto wallet drainers are malicious scripts that automatically transfer cryptocurrency from a victim’s wallet to an attacker-controlled address once the user connects their wallet to the fraudulent site. The site typically mimics legitimate cryptocurrency platforms, using social engineering tactics to trick users into authorizing transactions or revealing sensitive wallet information. Victims often lose their entire wallet balance in seconds, with no recourse for recovery. Analysis indicates this domain is part of a broader malicious infrastructure. The domain was registered on April 22, 2026, through Dynadot Inc, a registrar frequently used for short-lived phishing domains. It resolves to the IP address 188.114.97.3, hosted behind CloudFlare in Canada, a common tactic to obscure the true origin of the server. At the time of assessment, 8 out of 95 security vendors on VirusTotal flagged portal-usdai.com as malicious, and it appears on three security blocklists, including those maintained by cryptocurrency security entities. The SSL certificate is issued by Let’s Encrypt, a free and automated certificate authority often exploited by threat actors to lend a false sense of legitimacy to their sites. If you visited portal-usdai.com and connected your wallet, assume your funds have been compromised. Immediately disconnect your wallet from the site using a wallet management tool and revoke any suspicious transaction approvals. Transfer remaining assets to a new, secure wallet and monitor your transaction history for unauthorized activity. Report the domain to your wallet provider and relevant cryptocurrency security platforms to help prevent further victimization. Do not interact with any links or communications associated with this domain, as they may lead to additional phishing attempts or malware distribution.