mail[.]ussdtboost[.]xyz

Analysis of mail.ussdtboost.xyz confirms it as a brand impersonation scam targeting Compound Finance users, currently offline but previously active. The domain was registered on February 21, 2026, through Ultahost, Inc., and resolved to IP 37.27.71.198, hosted on Hetzner Online GmbH infrastructure (AS24940) in Finland. Nameservers ns1.dnspark.in and ns2.dnspark.in were configured, a common pattern in low-reputation hosting setups. No SSL certificate was detected, increasing exposure to interception risks.

The page title, 'USDT BOOST — Earn With Smart Plans,' explicitly promotes financial returns, aligning with known cryptocurrency investment scam tactics. Two of 93 security vendors on VirusTotal flagged the domain, and it appears on at least one blocklist, including PhishDestroy. Gridinsoft assigned a trust score of 0/100, further indicating malicious intent.

While the domain is currently offline, its infrastructure remains a potential vector for resurgence. Defenders should monitor for re-registration or DNS reactivation, block the IP and nameservers at perimeter controls, and alert users to the Compound Finance impersonation risk. No evidence of a phishing kit or specific lure content is available, but the combination of financial-themed branding, recent registration, and low detection coverage warrants continued vigilance.