flashusdtshop[.]store

The domain flashusdtshop.store was registered on February 21 2026 through Name.com, Inc. It resolves to IP 162.246.16.92, which belongs to AS19318 Interserver, Inc and is geolocated in the United States. The site serves a page titled “USDT Flow | Buy With UPI and Trc20 | Instant Delivery”, indicating a cryptocurrency purchase lure that targets users of UPI and TRC‑20 tokens. The web server runs LiteSpeed and supports HTTP/3; the connection is protected by a Let’s Encrypt certificate (E7). An HTTP 403 response is observed, suggesting the content may be hidden behind access controls or a redirect.

Reputation services assign extremely low scores: Scamadviser 1/100, Gridinsoft 0/100. The domain appears on one security blocklist and has been flagged by PhishDestroy. VirusTotal reports two of ninety‑three scanners labeling the domain as malicious, reinforcing the suspicion of phishing activity. The domain is currently active, with no indication of takedown.

Nameservers are spread across four distinct hostnames, a pattern often used to increase resilience. Given the combination of a high‑risk page title, low trust scores, blocklist presence, and vendor detections, the domain should be considered a high‑confidence phishing indicator. Defenders are advised to block flashusdtshop.store at DNS and proxy layers, add its IP 162.246.16.92 to network‑level deny lists, and monitor for any related C2 or credential‑stealing traffic. Continuous re‑scanning of the site and periodic review of the hosting provider’s IP range are recommended to catch potential re‑hosting attempts.