proposals-usdai[.]org

This domain, proposals-usdai.org, operates as a crypto drainer phishing site targeting users of the USD AI cryptocurrency platform. Analysis indicates the site mimics legitimate wallet interfaces to trick visitors into connecting their crypto wallets, enabling unauthorized transactions that drain funds. The page title 'USD AI' and infrastructure details suggest an intent to deceive users into believing they are interacting with an official USD AI service, while the actual functionality exfiltrates wallet credentials and executes unauthorized transfers. Evidence supporting this assessment includes detection by 2 out of 95 security vendors on VirusTotal, registration through PDR Ltd. d/b/a PublicDomainRegistry.com on April 04, 2024, and presence on 4 security blocklists. The domain resolves to IP address 172.67.157.145 and employs Cloudflare services, including Cloudflare Browser Insights and HTTP/3, to obscure its malicious activity. The creation date aligns with recent phishing campaigns targeting cryptocurrency users, and the domain has since been taken offline, though residual risks may persist. Users who visited proposals-usdai.org or connected a wallet to the site should immediately revoke any wallet permissions associated with the domain. Disconnect the wallet from all decentralized applications (dApps) and transfer remaining funds to a new, secure wallet. Monitor transaction history for unauthorized activity and report the incident to relevant blockchain security platforms. Given the elevated risk level, affected users should also consider enabling additional security measures, such as hardware wallet integration and multi-factor authentication for all crypto-related accounts.