predeposits[.]pages[.]dev

The domain predeposits.pages.dev is currently active and has been identified as a high-risk domain engaged in credential theft. The domain impersonates the brand USD.AI, potentially targeting users who are familiar with or interested in cryptocurrency services. The domain's current status as active poses a significant threat to unsuspecting users who may be tricked into revealing sensitive information.

Analysis indicates that predeposits.pages.dev has been flagged by 2 of 95 VirusTotal vendors, suggesting that it is recognized as a potential threat by a minority of security vendors. The domain is registered through Cloudflare, Inc. and resolves to the IP address 198.18.1.141, which is located in the United States under the AS13335 Cloudflare, Inc. network. The domain was created on November 20, 2025, and it appears on 2 security blocklists, including PhishDestroy and ScamSniffer. The lack of an SSL certificate further reduces the trustworthiness of the domain, making it more likely to be involved in malicious activities.

Given the current active status of predeposits.pages.dev, it is recommended that organizations and individuals take immediate action to protect themselves. Security teams should update their blocklists to include this domain and monitor for any attempts to access it. Users should be educated about the risks of credential theft and advised to avoid clicking on links from untrusted sources. Additionally, any interactions with this domain should be reported to security authorities to help mitigate the threat and protect a broader audience.