usdt-eth66[.]com

The domain usdt-eth66.com has been identified as a crypto wallet drainer targeting users of USDT and Ethereum (ETH) cryptocurrencies. Analysis indicates this domain is designed to facilitate unauthorized transactions by tricking victims into connecting their wallets to a malicious interface. As of the latest assessment, the domain is offline, though prior activity suggests it was actively used for credential theft and fund exfiltration. Infrastructure analysis reveals the domain was flagged by 9 of 95 security vendors on VirusTotal, indicating a high likelihood of malicious intent. It was registered through Gname.com Pte. Ltd. on December 07, 2025, and resolved to the IP address 104.21.0.105. The domain appears on one security blocklist and has a Gridinsoft trust score of 0/100. Detected technologies include jQuery, Cloudflare Browser Insights, Cloudflare, and HTTP/3, with an SSL certificate issued by Google Trust Services. The page title, 'Verification,' aligns with common tactics used in crypto wallet drainer schemes to simulate legitimacy. Current status confirms the domain has been taken offline, reducing immediate risk to users. However, the infrastructure and registration patterns suggest potential for re-emergence under a similar domain. Organizations and individuals are advised to block the domain and associated IP address at the network level. Cryptocurrency users should verify wallet connections exclusively through official platforms and enable multi-factor authentication. Monitoring for newly registered domains with similar naming conventions (e.g., 'usdt-eth' prefixes) is recommended to preempt further threats.