flashusdt[.]yzy-money[.]org

flashusdt.yzy-money.org was observed in a phishing campaign targeting users of USDT services. The domain was registered on 21 February 2026 through Hostinger Operations, UAB, and uses the default parking nameservers ns1.dns-parking.com and ns2.dns-parking.com. The site resolves to IP address 84.32.84.100, which is allocated to AS47583 Hostinger International Limited and geolocated to Lithuania. No TLS certificate is present, indicating the site is served over plain HTTP.

The page title returned by the web server is “Sign Up | Flash USDT”, suggesting an enrollment‑style lure. Google Safe Browsing classifies the URL as a social‑engineering threat, and one security blocklist has listed the domain. The PhishDestroy service has also blocked the address. On VirusTotal, a single of ninety‑three scanning engines reported a detection, reinforcing the malicious classification.

Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme risk. The domain is currently offline, as indicated by the status field, but its infrastructure components remain observable. Defenders should add the domain and its associated IP to local blocklists, monitor for any resurgence, and consider tightening e‑mail filters for messages referencing “Flash USDT”. Continuous observation of Hostinger‑hosted parking nameservers is advised, as they may be reused for future malicious domains.