flashusdtexpert[.]shop

This domain, flashusdtexpert.shop, was registered on February 21, 2026 through Dynadot LLC and is currently taken offline. The site presented a page titled “USDT Flow | Buy Flash USDT | Instant Delivery” and explicitly targeted the Binance brand, indicating a brand‑impersonation campaign. Infrastructure analysis shows the domain resolves to IP 162.246.16.92, hosted in the United States under AS19318 (Interserver, Inc). The server runs LiteSpeed and supports HTTP/3, and it presents a Let’s Encrypt certificate (E7), a free TLS provider frequently used by malicious operators. Nameservers da500a.trouble‑free.net and da500b.trouble‑free.net are listed for the domain.

Reputation services assign very low trust scores: Scamadviser 9 / 100 and Gridinsoft 0 / 100. Four of ninety‑three VirusTotal scanners flagged the domain, and it is listed on one external blocklist. PhishDestroy also reports the domain as blocked. The combination of a brand‑targeted page title, low trust scores, multiple vendor detections, and blocklist presence suggests a high likelihood of malicious intent.

The limited detection count does not rule out the presence of malicious payloads, and the offline status prevents direct observation of any credential‑collection forms or redirects. Defenders should continue to block the domain and its associated IP, monitor for any re‑use of the same infrastructure, and update detection rules to include the observed page title, TLS fingerprint, and server technology signatures. Additional scrutiny of the trouble‑free.net nameserver domain and any other domains sharing the same IP is recommended to uncover further components of the campaign. Network‑level controls such as URL filtering and outbound‑traffic monitoring to the IP address should be enforced to mitigate residual risk.