usdtcportal[.]xyz

This domain, usdtcportal.xyz, is flagged as a generic phishing site targeting cryptocurrency users under the guise of institutional USDT staking services. Analysis indicates the site mimics legitimate staking platforms, likely deploying credential-harvesting or wallet-draining scripts to exploit victims. The page title, 'USDTPORTAL | INSTITUTIONAL STAKING,' suggests an attempt to deceive users into believing it is an official or authorized service provider, though no legitimate affiliation exists. Infrastructure analysis reveals multiple technical indicators of compromise. The domain holds a VirusTotal detection score of 6/95, with security vendors confirming malicious intent. Registered through NameCheap, Inc. on February 21, 2026, it resolves to the IP address 185.199.108.153, a host commonly associated with content delivery networks but repurposed for phishing. The SSL certificate is issued by Let’s Encrypt, providing a false sense of security. Technologies detected include Varnish, GitHub Pages, and Fastly, which may have been exploited to obfuscate malicious activity. The domain appears on one security blocklist and is currently blocked by PhishDestroy. As of the latest assessment, usdtcportal.xyz has been taken offline, reducing immediate exposure. However, residual risk persists due to potential rehosting or domain resale. Users who interacted with the site should assume credential or wallet compromise and take corrective actions, including revoking active sessions, rotating passwords, and monitoring transaction histories. Organizations are advised to update blocklists and monitor for similar infrastructure patterns, such as domains leveraging GitHub Pages or Fastly with Let’s Encrypt certificates.