ai1115[.]com

Analysis of ai1115.com shows a newly registered domain created on 21 February 2026 through NameCheap, Inc. The domain resolves to the Cloudflare address 172.67.146.123, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. Traffic is protected by an SSL certificate issued by Google Trust Services under the WE1 authority, indicating the presence of HTTPS. The site’s front‑end stack includes Vue.js, the Marked markdown library, Cloudflare Browser Insights, and Baidu Analytics, and it serves content over HTTP/3, all of which were identified by passive fingerprinting tools. The only publicly visible page title is "USDT," but the site is currently taken offline, so its active content cannot be inspected.

Two of ninety‑three security vendors on VirusTotal have flagged the domain, suggesting malicious characteristics, and it is listed on one external security blocklist. Additional reputation services rate the domain poorly: Gridinsoft assigns a trust score of 6 out of 100, while Scamadviser gives a score of 1 out of 100. PhishDestroy has explicitly blocked the domain, reinforcing the classification as a phishing resource. The combination of a recent registration, low reputation scores, detection by multiple vendors, and confirmation from an anti‑phishing feed indicates a high likelihood that the domain was used for phishing, possibly targeting cryptocurrency users given the "USDT" title.

Uncertainty remains regarding the exact payload or victim interaction because the site is offline and no page content has been captured. Defenders should continue to block ai1115.com at perimeter and DNS filters, monitor for any resurgence of activity, and consider adding the domain to internal threat‑intelligence feeds. Continuous re‑evaluation is advised if the site reappears or if additional detection data become available.