secureusdt[.]com

Analysis of www.secureusdt.com shows an active credential phishing operation targeting cryptocurrency users. The domain was registered on February 21, 2026 through GoDaddy.com, LLC and resolves to IP address 13.235.157.37, which belongs to the Amazon.com, Inc. network (AS16509) located in India. DNS is served by ns63.domaincontrol.com and ns64.domaincontrol.com. The web server responds with HTTP 200 and presents a page titled "Secure USDT - Crypto Profits Platform". Detected technologies include Ubuntu, Ant Design, and Nginx, and the site uses a Let’s Encrypt TLS certificate (E7). The domain is currently listed on one security blocklist and has been blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, and 1 of 93 VirusTotal scanners flagged the domain, indicating at least one detection. The risk level is rated high and the threat category is credential phishing. Uncertainty remains regarding the specific phishing kit or credential collection mechanisms, as no page content analysis is available. Defenders should immediately block the domain and its associated IP address at perimeter defenses, update URL filtering and IDS signatures to include www.secureusdt.com, and monitor for any outbound connections to the hosting infrastructure. Users should be warned not to enter any login or wallet credentials on this site, and incident response teams should be prepared to investigate any compromised accounts that may have been exposed to this infrastructure.