treasury-usdai[.]xyz

PhishDestroy identifies treasury-usdai.xyz as an active generic phishing domain posing as a US Treasury or crypto-related service to harvest credentials and cryptocurrency. This domain resolves to IP 104.21.8.68 and leverages a Let's Encrypt SSL certificate to appear legitimate, likely targeting users expecting official government or financial portals. The domain was registered on April 06, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com, a commonly abused registrar for short-lived malicious domains. This domain was flagged by 3 out of 95 security vendors on VirusTotal, indicating limited but concerning detection. Its recent creation date and use of a free SSL certificate suggest opportunistic deployment in low-cost, high-impact phishing campaigns. Registrar and hosting patterns align with known bulletproof infrastructure used to evade takedowns and prolong operational lifespan. Users visiting this domain risk exposure to credential theft, malware download, or financial fraud under the guise of official financial services. If you visited treasury-usdai.xyz, immediately cease interaction and scan your device using updated antivirus software. Do not enter any credentials or cryptocurrency wallet information. Report the domain to your IT team or local cybersecurity authority. Block the domain and IP 104.21.8.68 at your network perimeter. Consider rotating passwords and monitoring financial accounts for unauthorized activity. Always verify domains using official sources before engaging with government or financial platforms.