# pay-for-usdt-trc20-000304.pages.dev — MALICIOUS

> PhishDestroy flags pay-for-usdt-trc20-000304.pages.dev as a crypto drainer impersonating USDT TRC20 services.

## Summary
PhishDestroy identifies pay-for-usdt-trc20-000304.pages.dev as an active high-risk crypto drainer campaign operating under Cloudflare Pages hosting. The domain resolves to IP 172.66.46.227 and leverages Google Trust Services SSL certificates to appear legitimate while impersonating USDT TRC20 payment gateways. This campaign specifically targets cryptocurrency users by offering fraudulent USDT TRC20 payment processing services designed to drain victim wallets through malicious smart contract interactions.

This domain was flagged by 15 out of 95 VirusTotal security vendors and blacklisted by Google Safe Browsing under SOCIAL_ENGINEERING classification. The domain is registered through Cloudflare, Inc. using Cloudflare Pages hosting infrastructure, which provides anonymity and abuse resistance. The SSL certificate issued by Google Trust Services further enhances credibility to deceive security-aware users. These technical indicators combine to create a sophisticated deception platform that bypasses traditional security measures through legitimate infrastructure abuse.

Users encountering this domain must immediately cease all interaction and verify the service through PhishDestroy's threat intelligence platform. Never connect cryptocurrency wallets to unknown websites, especially those offering free USDT or payment processing services. Always verify domains through official channels and use hardware wallet isolation for any transaction testing. Report this domain immediately to your wallet provider and social media platforms where it may be advertised to prevent further victimization.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.46.227

## Detection Status
- VirusTotal: 15 vendors flagged
- Google Safe Browsing: FLAGGED
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/domains/pay-for-usdt-trc20-000304.pages.dev
- PhishDestroy: https://phishdestroy.io/domain/pay-for-usdt-trc20-000304.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/pay-for-usdt-trc20-000304.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/pay-for-usdt-trc20-000304.pages.dev/
Last updated: 2026-04-08