usdt-26[.]com

Analysis of the domain usdt-26.com, created on 07 December 2025 and currently active, indicates a high‑risk crypto‑phishing operation. The authoritative nameservers julio.ns.cloudflare.com and marge.ns.cloudflare.com resolve the domain to the Cloudflare edge address 172.67.144.213, which is associated with ASN 13335 in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 root, confirming that HTTPS is enforced. HTTP requests return a 403 status code, suggesting intentional access restriction, while the page title “Verification” aligns with the reported crypto‑scam narrative.

Technical fingerprints show the presence of jQuery, Cloudflare services, and HTTP/3 support, typical of modern phishing kits hosted on content‑delivery networks. Reputation data is unfavorable: Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one security blocklist. PhishDestroy has already listed the host, and VirusTotal reports that 2 of 95 scanned vendors flag the domain as malicious. The registrar listed is Gname.com Pte. Ltd., a provider frequently associated with disposable registrations.

No additional public intelligence such as OTX tags or Safe Browsing entries is currently available. Uncertainty remains regarding the precise payload delivered after the verification step, as the content of the page has not been disclosed. Defenders should block network resolution to 172.67.144.213 for the domain usdt-26.com, enforce URL filtering against the known blocklist entry, and monitor for any outbound connections that may attempt to exfiltrate credentials. Continuous re‑scanning with VirusTotal and inclusion in internal threat‑intel feeds are recommended to capture any evolution of the indicator set.