secure-usdt[.]org

This domain, secure-usdt.org, was created on 21 February 2026 through NiceNIC International Group Co., Limited and is currently taken offline. DNS resolution points to 188.114.96.3, an address owned by AS13335 Cloudflare, Inc., located in the United States. The authoritative nameservers are grannbo.ns.cloudflare.com and kyree.ns.cloudflare.com, both Cloudflare‑operated, indicating the use of a reputable CDN for fast content delivery and possible abuse of cloud resources. No TLS certificate was observed, meaning the site served only HTTP, a common characteristic of credential‑phishing pages that rely on rapid deployment rather than encrypted traffic.

The site’s HTTP response returned the page title “Login | Skote Laravel 10 + Vue 3 Admin & Dashboard,” suggesting the landing page was built with the Skote admin template on a Laravel 10 backend and Vue 3 frontend. Such frameworks are frequently repurposed by threat actors to emulate legitimate dashboard interfaces and harvest credentials. Reputation checks show the domain appears on three public security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis recorded four of ninety‑three scanning engines flagging the domain as malicious, reinforcing the classification as credential phishing.

The absence of an SSL certificate, combined with the short registration age and the presence on multiple blocklists, raises the confidence that the infrastructure was deliberately prepared for short‑term phishing campaigns. Although the site is no longer reachable, historical snapshots can be retrieved from web archives to aid forensic analysis. Defenders should add 188.114.96.3 and the associated Cloudflare nameservers to network‑level deny lists, enforce strict outbound filtering for HTTP connections to unknown domains, and monitor for future registrations that reuse the same registrant or similar Skote/Laravel page titles.