usdt-one[.]com

This domain is flagged for elevated-risk brand impersonation targeting Binance, a major cryptocurrency exchange. The site presents itself as a legitimate USDT token purchase portal, using the page title 'usdtONE - Compre Tokens USDT com Segurança' to deceive users into believing it is an authorized Binance service. Brand impersonation of this nature typically aims to harvest credentials, distribute malware, or facilitate unauthorized transactions, posing significant financial and operational risks to affected parties.

Analysis indicates the domain usdt-one.com was registered on December 21, 2025, through Amazon Registrar, Inc. It resolves to the IP address 104.18.26.246, hosted on Cloudflare's infrastructure (AS13335). VirusTotal reports 9 out of 95 security vendors flagging the domain as malicious, while it appears on two security blocklists. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy. The domain has since been taken offline, but its infrastructure and registration details remain relevant for historical and forensic analysis.

Mitigation steps for this threat type include immediate blacklisting of the domain and associated IP address (104.18.26.246) across network security controls. Organizations should alert users to the specific page title and branding used in this campaign to prevent social engineering attempts. Monitoring for similar domains registered through Amazon Registrar or resolving to Cloudflare IPs may help identify related threats. Additionally, enforcing multi-factor authentication (MFA) and transaction verification protocols can reduce the risk of unauthorized access or fund transfers stemming from such impersonation attempts.