usdtspin.cc was registered on July 28, 2026 through Spaceship, Inc. The domain is delegated to Cloudflare nameservers ernest.ns.cloudflare.com and rosalie.ns.cloudflare.com and resolves to the Cloudflare edge address 172.67.208.248. VirusTotal records show that 2 of 91 security vendors have flagged the domain, indicating a low but non‑zero detection rate. The domain is currently listed on three public security blocklists and is actively blocked by the PhishDestroy, MetaMask, and SEAL filtering services.
Its status is reported as active as of the analysis date, July 30, 2026. The available telemetry does not include a published SSL certificate fingerprint, HTTP response code, or Safe Browsing verdict, and no public OTX indicator has been observed for this FQDN. Consequently, analysts cannot confirm the presence of additional defensive signals beyond the blocklist entries and the limited vendor detections.
The infrastructure relies on Cloudflare’s CDN, which masks the underlying origin server and complicates attribution. Defenders should continue to enforce blocklist rules for usdtspin.cc, monitor the associated IP address 172.67.208.248 for any anomalous traffic, and consider adding the domain to local deny lists. Ongoing observation is recommended to capture any future changes in detection scores, SSL deployment, or content that would clarify the phishing campaign’s target and tactics.