cousdt[.]com

Analysis of cousdt.com reveals an active high-risk phishing domain targeting the Twitter brand, registered on December 5, 2024, through Sav.com, LLC. The domain resolves to IP address 172.67.183.154 and presents a page titled 'COusdt,' though the exact content and functionality remain unconfirmed. Current detection metrics indicate broad recognition as malicious, with 12 of 95 security vendors flagging the domain on VirusTotal. The domain appears on five security blocklists and is referenced in 22 threat intelligence pulses on AlienVault OTX, suggesting persistent malicious activity. Infrastructure analysis identifies the use of Node.js, Envoy, Express, HSTS, and Akamai technologies, alongside a GoDaddy-issued SSL certificate, which may be leveraged to enhance perceived legitimacy. Defenders should note the domain's low trust scores—1/100 from Scamadviser and 0/100 from Gridinsoft—alongside active blocking by multiple security tools. The registration date, while recent, aligns with typical phishing domain lifecycle patterns. Uncertainties remain regarding the specific monetization mechanism, though the 'COusdt' page title may imply cryptocurrency-related fraud. No confirmed phishing kit or additional infrastructure details are available at this time. Given the domain's continued activity and widespread detection, immediate blocking at the network and endpoint levels is recommended, along with monitoring for related domains registered under the same registrar or resolving to the same IP.