x-usdt[.]xyz

The domain x-usdt.xyz, associated with a generic phishing operation, has a high threat score of 75/100 and is currently down. It has been flagged by 3 out of 95 security vendors, including alphaMountain.ai, Forcepoint ThreatSeeker, and SOCRadar, indicating a recognized malicious presence. The domain is also listed on one public blocklist, although it is not flagged by Google Safe Browsing, which suggests that it may not have been widely reported prior to its takedown.

Registered with NameSilo, LLC in the United States, x-usdt.xyz was created on February 21, 2026, and was first seen in databases on January 24, 2026. The hosting IP address is 74.48.78.156. The relatively recent registration and the fact that the site is now down may indicate a swift response to its malicious activity, although the absence of a brand being impersonated suggests it operated as a generic scam rather than targeting a specific entity.

The detection of this domain by a small number of vendors, combined with its presence on a public blocklist, highlights the potential for it to have been part of a broader phishing campaign. The lack of additional flags from Google Safe Browsing could imply that the domain was not widely recognized before its shutdown, but its high threat score indicates a significant risk during its operational period.

Given the high threat level associated with this domain, it is recommended to block x-usdt.xyz at the perimeter and submit a report to the registrar's abuse desk to prevent any future misuse. Additionally, flagging the hosting IP 74.48.78.156 as an indicator of compromise (IOC) may assist in monitoring for related malicious activities.