usdtrouter[.]com

This domain is flagged for hosting a crypto drainer phishing scheme targeting users of cryptocurrency platforms. Analysis indicates the site impersonates TokenPower.ai, a crypto-native AI platform, to deceive victims into connecting wallets and authorizing malicious transactions. The threat type is classified as elevated due to the direct financial risk posed by unauthorized asset transfers, a tactic commonly associated with wallet-draining malware. Infrastructure analysis reveals multiple high-risk indicators. The domain usdtrouter.com resolves to IP address 104.21.35.64 and was registered on April 7, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It appears on one security blocklist and holds a Gridinsoft trust score of 0/100. The SSL certificate is issued by Google Trust Services, a common feature in phishing domains to mimic legitimacy. VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious, with detections specifically tied to crypto-related fraud. Mitigation requires immediate action to prevent financial loss. Users who interacted with this domain should revoke all connected wallet authorizations via blockchain explorers or dedicated revocation tools. All transactions associated with the domain’s smart contracts should be audited for unauthorized transfers. Wallet software should be scanned for malware, and hardware wallets considered for future storage. Cryptocurrency platforms and exchanges should block the domain and its resolved IP in network security policies. Security teams are advised to monitor for additional domains registered under the same registrar or resolving to the same IP range, as threat actors frequently reuse infrastructure.