# www.pay-usdt.org — SUSPICIOUS

> Pay-USDT.org is a live crypto drainer impersonating USDT services. This domain, created May 15 2022, currently shows 0/95 VirusTotal detections.

## Summary
PhishDestroy identifies www.pay-usdt.org as an active crypto-draining phishing portal posing as a USDT service site. Visitors are urged to avoid entering wallet details or clicking any prompts, as the infrastructure pulls funds without consent once credentials or private keys are submitted.

This domain was flagged with zero out of ninety-five VirusTotal engines detecting the threat as of this advisory. Registrar records show Gandi SAS handled the May 15 2022 creation, and the site currently resolves to 104.21.90.82 under a Google Trust Services SSL certificate, a combination often used to lend false legitimacy to malicious endpoints.

If you visited pay-usdt.org, disconnect any connected wallets immediately and scan devices with updated anti-malware tools. Revoke any approvals granted to unknown contracts and transfer remaining assets to a fresh wallet. Report the domain to your security team and PhishDestroy for takedown using seed 5664ef.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2022-05-15 04:59:36
- Registrar: Gandi SAS
- IP: 104.21.90.82

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/ef686711-38a7-49c5-bec7-2fd0cd489cba
- PhishDestroy: https://phishdestroy.io/domain/www.pay-usdt.org/
- LLM endpoint: https://phishdestroy.io/domain/www.pay-usdt.org/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/www.pay-usdt.org/
Last updated: 2026-03-29