usdtswap[.]icu

This domain, usdtswap.icu, is identified as a crypto drainer phishing site designed to impersonate legitimate USDT (Tether) swap platforms. Analysis indicates the infrastructure is engineered to deceive users into connecting cryptocurrency wallets, likely executing unauthorized transactions to drain funds. No explicit brand logos or trademarks are replicated, but the domain name and page structure mimic decentralized finance (DeFi) swap interfaces, a common tactic in cryptocurrency phishing campaigns targeting unsuspecting users seeking token exchanges or liquidity provision. Technical indicators confirm elevated risk. The domain was registered on April 7, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with malicious domains. VirusTotal detection metrics show 5 out of 95 security vendors flagging usdtswap.icu as malicious. AlienVault OTX records the domain in one threat intelligence pulse, while a single security blocklist (PhishDestroy) has listed it. No associated IP addresses or Google Safe Browsing (GSB) entries were identified in the available data, suggesting either rapid takedown or evasion techniques. The domain's creation date, combined with its immediate malicious activity, aligns with patterns observed in short-lived phishing operations. As of the latest assessment, usdtswap.icu is offline, indicating successful mitigation efforts by hosting providers or registrars. However, residual risk persists due to potential re-registration under altered infrastructure or similar domain names. Users who interacted with the site are advised to revoke any connected wallet permissions, monitor transaction histories for unauthorized activity, and verify domain authenticity before engaging with cryptocurrency platforms. Organizations should update blocklists to include this domain and monitor for related indicators of compromise, such as associated IP ranges or SSL certificates, to prevent future exposure.