usdai-predeposit[.]net

The domain usdai-predeposit.net was first registered on 19 November 2025 through OwnRegistrar, Inc. It resolves to the IP address 142.250.186.110, which is announced by AS15169 and located in Germany under Google LLC’s network. The use of an IP owned by Google provides a superficial layer of credibility that is often leveraged in brand‑impersonation campaigns. No TLS certificate was present at the time of analysis, and the site failed to obtain a score from Gridinsoft, receiving a trust rating of 0 / 100, indicating a lack of reputable security posture. Content‑level observation is limited to the page title returned by the server, which is the literal string “https://predeposits.pages.dev/”.

The title does not reveal any further functional information, and the site was reported as taken offline when queried on 22 July 2026. Despite the offline status, the domain remains listed on two independent blocklists, PhishDestroy and ScamSniffer, confirming that security‑focused services have identified it as malicious. VirusTotal analysis shows that five of ninety‑five scanning engines flagged the domain, reinforcing the suspicion. The domain’s configuration uses Cloudflare’s authoritative name servers adelaide.ns.cloudflare.com and damian.ns.cloudflare.com, a common choice for fast‑changing malicious infrastructure.

The combination of Google‑owned hosting, absence of encryption, low trust score, and detection by multiple vendors aligns with the declared scam type of brand impersonation targeting Google. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated IP and name servers, and update any URL filtering lists to include usdai‑predeposit.net. Ongoing observation is recommended in case the operator re‑activates the site or repurposes the same infrastructure for future campaigns.