Notification and current-status evidence
The sent-report ledger records the first outgoing report at .
The recorded recipient is abuse@nicenic.net.
The latest stored availability evidence still shows the domain reachable; 4 months has elapsed since the first outgoing report.
ICANN RAA §3.18 describes registrar abuse-contact and handling obligations. This section records outgoing timestamps, listed recipients, case identifiers, and later availability. It does not by itself prove receipt, acknowledgement, investigation, remediation, or contractual non-compliance.
usdt-x[.]exchange
“Swap USDT to Monero (XMR) No KYC Instant Private Exchange”
This domain, usdt-x.exchange, operates as a fraudulent cryptocurrency exchange platform offering instant USDT-to-Monero swaps without identity verification. Analysis indicates the site is designed to deceive users into transferring Tether (USDT) under the pretense of converting it to Monero (XMR), a privacy-focused cryptocurrency. Victims are likely to lose funds permanently, as transactions on such platforms are irreversible and untraceable once processed. The site exploits the anonymity of Monero to obscure fraudulent activity, making recovery efforts nearly impossible for affected users. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain is flagged by 6 out of 95 security vendors on VirusTotal, including detection by blockchain security systems and anti-phishing tools. It was registered on April 7, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The site resolves to the IP address 172.67.201.174 and appears on three security blocklists, including MetaMask and PhishDestroy. Additionally, it has been documented in one AlienVault OTX threat intelligence pulse, further confirming its malicious classification. If you visited usdt-x.exchange or interacted with the platform, immediate action is required. First, cease all communication and transactions with the site. If you connected a wallet or entered private keys, consider the wallet compromised and transfer remaining assets to a new, secure wallet using a different device. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to your local cybercrime unit and relevant blockchain analytics platforms to assist in tracking the fraudulent activity. Never reuse passwords or recovery phrases associated with the compromised interaction.
Network Security Intelligence Registrar context
| Detection System | Indicator | Verdict | Alert |
|---|---|---|---|
| Hagezi Threat Feed | usdt-x.exchange |
malicious | Sinkholed |
| DNS4EU | usdt-x.exchange |
malicious | Sinkholed |
Threat Response Pipeline
Public Blocklist Status
Stored Capture
Domain Intelligence
Technical detailsDNS, SSL SANs, timestamps
ICANN OVERSIGHT
Accreditation and RAA context
Accreditation and RAA context
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Latest Classified Outcome 2026-08-15 02:48:46 UTC
Forensic Intelligence
VirusTotal Analysis
Archived Evidence
Site Performance Analysis
Google PageSpeed Insights — mobile performance audit of usdt-x.exchange · checked Jun 26, 2026
Evidence & External Reports
PD-20260407-29EFBD Recipient: abuse@nicenic.net Were You Affected by This Site?
If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.
Report to Your Local Authorities
Select your country to get official cybercrime contacts, or create a complaint draft →.
Check Any Domain
Threat analysis using stored blocklist, WHOIS, DNS, and public scan evidence
Scan NowReport Phishing
Submit suspicious domains to our threat database — protect the community
ReportLive Threat Feed
Recent phishing reports and observed availability changes
MonitorStay Informed, Stay Safe
Monitor live threats or contest this listing if you believe it's a false positive