usdt[.]trc2000[.]xyz

The domain usdt.trc2000.xyz is currently active and has been classified as a high‑risk generic phishing campaign targeting cryptocurrency wallets. The site presents a page titled "Token数字钱包" and is identified as a wallet drainer, a tactic frequently used to lure victims into submitting private keys or seed phrases. The threat was first observed after the domain was registered on April 08, 2026, and it remains reachable with an HTTP 200 response.

Infrastructure analysis shows that the domain resolves to the IPv4 address 45.207.197.54, which is geolocated to Hong Kong and appears to be operated by Vapeline Technology. The domain is registered through Go Daddy, LLC, and uses the authoritative name servers ns59.domaincontrol.com and ns60.domaincontrol.com. The TLS certificate presented is issued by TrustAsia Technologies, Inc. under the LiteSSL RSA CA 2025, indicating a relatively recent procurement of SSL services.

Reputation data reveal a Gridinsoft trust score of 0 out of 100 and placement on a single security blocklist, reflecting an extremely low confidence in the site's legitimacy. VirusTotal analysis records 13 out of 95 security vendors flagging the domain as malicious, reinforcing the assessment of a hostile operation. The site is already blocked by the PhishDestroy blocklist, which suggests that at least one defensive feed is actively mitigating traffic to the address.

Defenders should prioritize blocking the domain and its associated IP address at perimeter and endpoint layers. Monitoring for DNS queries to usdt.trc2000.xyz and its name servers can provide early indicators of infection attempts. Given the wallet‑draining nature of the content, users handling cryptocurrency should be advised to verify URLs rigorously and avoid entering seed phrases on any untrusted web interface. Continued observation of the IP and any related infrastructure is recommended to detect potential pivoting or redeployment of the phishing campaign.