wallet[.]smoothusdt[.]com

Analysis of wallet.smoothusdt.com shows it was registered on February 21, 2026 through Cloudflare, Inc. The domain resolves to the Cloudflare edge address 104.21.54.140, which is associated with ASN 13335 and located in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 label, indicating a valid HTTPS handshake. An HTTP request returns status code 403, suggesting the front‑end is intentionally restricting access, a pattern often used by malicious actors to hide content until specific conditions are met. The page title returned by the server is “Smooth USDT”, and the supplied intelligence classifies the activity as a crypto scam, specifically a crypto drainer.

VirusTotal analysis records a single positive detection out of 93 scanned engines, and the domain appears on one external blocklist. Reputation services assign a Gridinsoft trust score of zero out of one hundred, reinforcing the malicious assessment. The domain is currently listed as blocked by the PhishDestroy service, and the same Cloudflare nameservers (iris.ns.cloudflare.com, stan.ns.cloudflare.com) are used. The combined indicators – recent registration, exclusive use of Cloudflare infrastructure, a legitimate‑looking SSL certificate, a 403 response, low trust score, and a positive detection on VirusTotal – suggest that the domain is being leveraged to lure victims into transferring USDT or other stablecoins to attacker‑controlled wallets.

No additional content has been captured, so the exact landing page or social engineering vector remains unknown. Defenders should treat any traffic to wallet.smoothusdt.com as malicious, enforce network‑level blocking, and monitor for outbound cryptocurrency transactions targeting addresses associated with the domain. Endpoint security solutions should flag any attempts to resolve or contact the domain, and threat‑intel feeds should be updated to include its IP address and nameserver configuration.