sai-secure[.]com

This domain, sai-secure.com, is actively engaged in credential theft operations targeting users under the pretense of providing private and secure AI services. Analysis indicates the site impersonates legitimate AI security platforms to deceive visitors into submitting sensitive login credentials, which are then harvested for unauthorized access to accounts or further malicious activity. The threat specifically exploits interest in AI-driven privacy solutions, a growing trend among both individual and enterprise users seeking secure digital environments. Infrastructure analysis reveals the domain was registered on May 24, 2026, through a registrar associated with Cloudflare, Inc., and currently resolves to the IP address 172.67.193.210. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy. Security telemetry shows the domain appears on three distinct blocklists, while VirusTotal reports detection by 1 of 95 security vendors. The page title, 'SAI | Private, secure AI,' reinforces the deception by aligning with terminology used by trusted AI service providers. Users who have visited sai-secure.com or entered credentials on the site should immediately revoke access to any associated accounts, particularly those linked to AI tools, cloud services, or financial platforms. Reset passwords using a secure, unrelated device and enable multi-factor authentication where available. Monitor accounts for unauthorized activity, including logins from unfamiliar locations or devices. If payment details or recovery information were submitted, contact financial institutions to flag potential fraud. Organizations should block the domain and IP at the network level and alert employees to the credential theft campaign targeting AI-related services.