usdtl0[.]to

The domain usdtl0.to is a known brand impersonation phishing site that specifically impersonates Google. This site poses an elevated risk to users, as it is designed to trick them into divulging sensitive information such as login credentials. The site is currently taken offline, but users who may have interacted with it should take immediate steps to secure their accounts and data.

usdtl0.to is registered through NiceNIC International Group Co., Limited and was created on October 30, 2025. The domain resolves to the IP address 2a06:98c1:3120::3, which is located in the US under the AS13335 Cloudflare, Inc. network. The SSL certificate for this domain is issued by Google Trust Services / WE1. Despite its current offline status, the domain has been flagged by 2 of 95 vendors on VirusTotal, including Fortinet and SOCRadar. It also appears on 3 security blocklists: PhishDestroy, MetaMask, and SEAL. The page title observed was 'Transfer', and the technologies detected include Google Web Server, HSTS, and HTTP/3.

To mitigate the risks associated with usdtl0.to, users should change their Google account passwords immediately and enable two-factor authentication if not already set up. They should also monitor their accounts for any unauthorized activity and report any suspicious incidents to Google. If users suspect they have been compromised, they can report the phishing domain to PhishTank, Google Safe Browsing, and their local cybersecurity authorities. Additionally, it is advisable to avoid clicking on links from unknown sources and to verify the URL of any website requesting sensitive information.