usdtflowx[.]work

The domain www.usdtflowx.work was registered through GoDaddy.com, LLC on April 03, 2026 and currently resolves to the IPv4 address 119.18.54.54. The host is located in India and is served by the authoritative name servers ns49.domaincontrol.com and ns50.domaincontrol.com, both operated by the registrar. The site presents an HTTPS service using a Let’s Encrypt certificate issued for the current year.

Automated scans report an HTTP 406 response, indicating the server deliberately rejects content negotiation for the request. VirusTotal has recorded detections from 7 of 95 scanned security vendors, which is a modest but notable count for a newly created domain. The Gridinsoft trust score is 0 out of 100, and the domain appears on a single public blocklist. PhishDestroy has actively blocked the host, confirming its use in malicious campaigns.

The available intelligence does not reveal the exact phishing kit or the brand being impersonated. No payload samples or screenshot evidence have been published, leaving the visual content of the site unknown. While the HTTPS certificate is valid, the presence of a low‑trust score and vendor detections strongly suggest the site is being used to harvest credentials or deliver fraudulent pages, consistent with generic phishing activity observed in other recent campaigns.

Defenders should add www.usdtflowx.work to domain‑based deny lists and monitor traffic to 119.18.54.54 for suspicious authentication attempts. Email gateways should block URLs containing the domain and inspect inbound messages for links directing users to the site. Continuous re‑evaluation is advised, as further indicators such as phishing page screenshots or malware samples could emerge.