usdai[.]fi

PhishDestroy identifies usdai.fi as an active generic phishing domain designed to mimic legitimate USD stablecoin platforms and harvest user credentials. The site remains under active threat investigation as of the most recent intelligence update. usdai.fi was registered through Immaterialism Ltd on November 24, 2025 and resolves to IP address 23.254.253.96. VirusTotal currently shows zero detections across 95 vendor engines, indicating it remains undetected by most scanning tools. The domain operates with a Let's Encrypt SSL certificate, enhancing its appearance of legitimacy. As of the latest assessment, the domain has not been listed on any public blocklists, and domain trust scores remain uncompromised at this time. The threat remains active and evolving, with a low but present risk of user compromise due to its credible presentation and undetected status. Organizations and individual users should block traffic to 23.254.253.96 at the network perimeter and flag usdai.fi as a malicious domain in DNS and proxy filters. All employees and customers should be warned against interacting with the domain or submitting any credentials. Continuous monitoring is recommended given the absence of current detection coverage.