transfer-usdt[.]shop

transfer-usdt.shop was observed hosting a page whose title is “React App”. The site was built on a React front‑end and served through LiteSpeed web server on a Hostinger‑managed environment, using HTTP/3. DNS resolves to the IP address 145.79.211.22, which belongs to Hostinger International Limited in India. Registration details show the domain was created through Hostinger Operations UAB and uses the generic parking nameservers ns1.dns-parking.com and ns2.dns-parking.com.

The TLS certificate is issued by Let’s Encrypt, confirming the presence of HTTPS. Threat intelligence classifies the domain as a “Fake Exchange” phishing operation; it appears on a single blocklist and has been explicitly blocked by PhishDestroy. VirusTotal scans returned detections from two of ninety‑four AV engines, indicating some malicious content was identified. The site is currently offline, and its status is recorded as taken offline.

Analysis indicates that the infrastructure—shared hosting on Hostinger, a generic parking name server configuration, and a publicly‑trusted certificate—makes the domain easy to provision and quickly retire, a pattern common to short‑lived phishing campaigns. The limited blocklist presence and low number of AV detections suggest the domain may have been active for a brief window before takedown. Defenders should continue to monitor host‑level activity on the IP 145.79.211.22 for any resurgence, add the domain and its IP to internal deny lists, and consider pre‑emptively blocking similar Hostinger‑registered domains that serve React‑based pages with generic titles. Ongoing vigilance is recommended because the underlying hosting provider can be reused for future campaigns.