usdt-trc20[.]info

On July 22, 2026, threat analysts examined the domain usdt-trc20.info, which is classified as a crypto‑scam brand‑impersonation campaign targeting the CSGO community. The domain was registered on February 21, 2026 through Gname.com Pte. Ltd. and uses the authoritative name servers a.share-dns.com and b.share-dns.net. DNS resolution points to the IP address 194.110.247.196, which belongs to AS200019 ALEXHOST SRL and is geolocated in Moldova. No TLS certificate is present, indicating the site operated without HTTPS. The page title retrieved during the brief crawl was "AML," providing no further context about the malicious payload.

VirusTotal analysis shows that three of ninety‑three antivirus engines flagged the domain, confirming suspicious activity despite the low detection count. Independent security feeds have taken action: PhishDestroy lists the domain as blocked, and it appears on one additional security blocklist. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the assessment of high risk. The current operational status is offline, which prevents direct observation of the site’s content, but historical data suggest a typical crypto‑drain workflow.

Defenders should proactively block the domain at DNS, proxy, and firewall layers, and monitor for any future re‑registration of the same second‑level name or similar IP ranges. Continuous scanning of newly resolved hosts from the ALEXHOST SRL ASN is advised, as the infrastructure may be reused for other campaigns. Given the lack of SSL, any attempts to serve malicious payloads would be delivered over clear‑text HTTP, making network‑level inspection feasible. Analysts are encouraged to correlate any observed traffic to the domain or its IP with the known page title "AML" and the CSGO brand reference to improve detection fidelity.