usdtscanner[.]online

This domain, usdtscanner.online, is flagged as a generic phishing site targeting users of USDT BEP-20 tokens. Analysis indicates the site impersonates a legitimate token verification or scanning service, likely designed to harvest wallet credentials, private keys, or seed phrases under the pretense of validating USDT transactions. The page title, 'USDT SCANNER - Verify Your USDT BEP-20 Tokens,' directly supports this assessment, as no legitimate blockchain scanner would require sensitive user credentials for basic transaction verification. No specific drainer kit signatures were identified in initial scans, but the domain aligns with common phishing tactics observed in cryptocurrency fraud campaigns. Technical indicators confirm elevated risk. The domain was registered on February 21, 2026, through Go Daddy, LLC, and resolves to IP address 185.158.133.1. VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Infrastructure analysis reveals the use of Cloudflare, which may obscure backend hosting details, and the presence of HSTS, suggesting an attempt to appear legitimate while masking malicious intent. As of the latest assessment, usdtscanner.online has been taken offline, reducing immediate exposure risk. However, the domain remains registered and could be reactivated or repurposed for future phishing campaigns. Users who interacted with the site are advised to revoke any connected wallet permissions, rotate private keys, and monitor for unauthorized transactions. Network defenders should update blocklists to include this domain and its associated IP, while cryptocurrency platforms should warn users against unsolicited verification requests. The elevated risk classification persists due to the domain's registration status and historical malicious activity.