usdt[.]tommyhill[.]in

The domain usdt.tommyhill.in is currently active and has been identified as a brand‑impersonation campaign targeting the cryptocurrency platform Aave. Registration records show the domain was created on 21 February 2026 through HOSTINGER operations, UAB, and it is hosted on Hostinger infrastructure (AS47583, Lithuania) with the resolved address 92.113.23.119. The site is served behind Hostinger’s CDN and supports HTTP/3, returning an HTTP 403 status for the initial request. The presented page title, “USDT – Trading for everyone,” is the only publicly visible content extracted from the site; no further page elements have been analyzed.

Security‑vendor scans on VirusTotal indicate that 2 of 93 scanners flagged the domain, and the Gridinsoft trust score is 0 / 100, reflecting a highly suspicious rating. The domain appears on a single blocklist, PhishDestroy, and its SSL certificate is issued by Let’s Encrypt (R13), indicating a valid TLS configuration despite the malicious intent. Nameservers are ns1.dns-parking.com and ns2.dns-parking.com, typical of parked or redirected domains. The combination of a newly registered domain, low trust score, detection by multiple scanners, and inclusion on a phishing blocklist suggests an operational infrastructure designed to lure victims seeking USDT trading services and to harvest credentials or funds under the guise of Aave.

Defenders should add the domain and its resolved IP to network‑level deny lists, ensure web‑proxy and DNS filtering solutions block the host, and monitor for any related hostnames that resolve to the same IP range. Continuous re‑scanning with multi‑vendor services is advised to capture any evolution of the payload or additional detections. At present, no further evidence of the phishing kit or page content has been disclosed, leaving the precise attack vector uncertain.