usdt-core[.]pro

This domain, usdt-core.pro, is confirmed to operate as a crypto drainer, specifically designed to impersonate the USDT Core wallet interface. Analysis indicates the site targets users of Tether (USDT) and other cryptocurrencies by presenting a fraudulent wallet management portal. Once users connect their wallets or input private keys, the site executes unauthorized transactions, draining assets to attacker-controlled addresses. The page title 'USDT Core' and the domain name itself reinforce the deception by mimicking legitimate blockchain infrastructure. Infrastructure analysis reveals the domain was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. It resolved to the IP address 188.114.96.3 and was flagged by 2 out of 95 security vendors on VirusTotal, indicating limited but targeted detection. The domain appears on one security blocklist and was actively blocked by at least one anti-phishing system prior to being taken offline. The creation date, combined with the low detection rate, suggests the infrastructure was deployed with the intent to evade automated defenses. Users who visited usdt-core.pro or interacted with its content should immediately revoke any wallet connections made through the site. All connected wallets should be audited for unauthorized transactions, and remaining assets should be transferred to a new, secure wallet. Private keys or seed phrases entered on the site must be considered compromised and should no longer be used. Monitoring for unusual activity on linked accounts is recommended, and affected users should report the incident to relevant blockchain security teams or incident response platforms for further mitigation.