# pay-for-usdt-trc20-000264.pages.dev — MALICIOUS

> pay-for-usdt-trc20-000264.pages.dev masquerades as a TRC-20 USDT payout site distributing malware. 15 security vendors flag this Cloudflare-hosted domain.

## Summary
pay-for-usdt-trc20-000264.pages.dev is a recently activated fake payout portal that purports to offer TRC-20 USDT payouts in exchange for an up-front fee or wallet connection. Threat analysts classify this site as a generic phishing domain designed to harvest cryptocurrency and credentials from users seeking passive income opportunities. No specific brand is being impersonated; instead the lure is an enticing promise of immediate USDT earnings, suggesting criminals are running a broad “get-rich-quick” campaign rather than a targeted brand hijack.  

This domain was registered through Cloudflare, Inc. and resolves to IP address 188.114.96.3. VirusTotal shows a detection ratio of 15 out of 95 scanners (elevated risk) and the site holds a valid Google Trust Services SSL certificate to appear trustworthy. The domain resolves via Cloudflare Pages, a legitimate platform abused for fast deployment and bulletproof hosting. With only 15/95 detections, the campaign is still under the radar for many filters, increasing its chances of reaching potential victims before reputation-based blocks kick in.  

PhishDestroy identifies the site as ACTIVE as of seed 6d83d4 and continues to serve malicious content. Immediate actions for defenders include DNS sink-holing the IP 188.114.96.3 and adding the full domain to blocklists. Users should avoid any site claiming instant USDT payouts and verify offers through official channels. Remaining risk is elevated due to low AV coverage and the use of trusted infrastructure, making this a campaign worth monitoring closely through threat intel feeds.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 15 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/domains/pay-for-usdt-trc20-000264.pages.dev
- PhishDestroy: https://phishdestroy.io/domain/pay-for-usdt-trc20-000264.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/pay-for-usdt-trc20-000264.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/pay-for-usdt-trc20-000264.pages.dev/
Last updated: 2026-04-08