proposals-usdai[.]xyz

This domain, proposals-usdai.xyz, operates as a crypto drainer phishing site designed to steal digital wallet credentials and drain cryptocurrency funds from victims. Analysis indicates the site mimics legitimate decentralized finance (DeFi) platforms, tricking users into connecting wallets or entering seed phrases under false pretenses, such as claiming to offer token swaps or airdrops. Once credentials are entered, the site executes unauthorized transactions, transferring assets to attacker-controlled wallets without user consent. The threat primarily targets users of popular wallets and DeFi services, exploiting trust in branded interfaces and urgency-driven offers. Infrastructure analysis reveals multiple red flags confirming the malicious nature of this domain. The domain was registered on April 7, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with phishing and fraudulent domains. At the time of assessment, the domain resolved to the IP address 188.114.97.3 and was flagged by 6 out of 95 security vendors on VirusTotal, including detections for phishing and malicious activity. Additionally, the domain appeared on three security blocklists and was proactively blocked by multiple wallet security providers. A trust score of 0/100 from Gridinsoft further corroborates the high-risk classification of this infrastructure. Users who visited proposals-usdai.xyz or interacted with its content should take immediate action to mitigate potential losses. First, disconnect any wallets linked to the site by revoking permissions via the wallet’s connected apps or dApp browser settings. Next, transfer remaining funds to a new, secure wallet using a trusted device, as the original wallet may be compromised. Monitor transaction histories for unauthorized activity and report any suspicious transactions to the wallet provider or relevant blockchain explorers. If seed phrases or private keys were entered, consider the wallet fully compromised and avoid using it for future transactions. Finally, scan the device used to access the site for malware, as phishing pages may deploy additional payloads. Users are advised to enable multi-factor authentication on all accounts and verify domain authenticity before interacting with any financial or DeFi platforms.