proposal-usdai[.]com

The domain proposal-usdai.com was registered on March 5 2026 through Real‑time Register B.V. and is currently hosted behind Cloudflare (ASN 13335) with the IP address 104.21.81.86 located in the United States. The site presents an SSL certificate issued by Let’s Encrypt (E7) and returns an HTTP 403 status code, indicating that direct content retrieval is blocked. The page title observed is “USD AI”, which does not reference the targeted brand. Intelligence indicates the domain is being used for a wallet/seed phishing campaign that impersonates Telegram, as the brand target field lists Telegram. VirusTotal analysis shows that one of ninety‑four security vendors flagged the domain, and the domain appears on three external blocklists, including PhishDestroy, MetaMask, and SEAL.

The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment. Nameserver configuration uses koa.ns.cloudflare.com and lily.ns.cloudflare.com, consistent with the Cloudflare front‑end. The domain’s current status is offline, suggesting the operators have taken the site down, but the infrastructure remains observable. Defenders should treat any communications that reference proposal‑usdai.com as malicious, especially those requesting cryptocurrency wallet credentials or seed phrases.

Blocking the domain at the DNS or proxy level is advised, as is adding the IP address 104.21.81.86 to deny lists. Monitoring for re‑registration or the appearance of similar domains using the same registrar or Cloudflare infrastructure can help detect rapid re‑deployment. Because the site was flagged by multiple anti‑phishing products, security tools that rely on reputation data should already be alerting; however, ensuring that endpoint protection and email security gateways incorporate the latest blocklist entries will reduce exposure.