usdt-two[.]com

Analysis performed on 24 July 2026 indicates that the domain usdt-two.com was actively serving a page titled “USD2 Airdrop”. The site resolved to the IP address 172.67.173.175, which is owned by Cloudflare, Inc. (ASN 13335) and geolocated to the United States. Registration data show the domain was created on 4 September 2025 through Web Commerce Communications Limited and is served by the Cloudflare authoritative name servers arya.ns.cloudflare.com and phil.ns.cloudflare.com. No TLS certificate was observed, and the site was reachable via HTTP only before it was taken offline.

Reputation services have flagged the domain: two of ninety‑five antivirus engines on VirusTotal reported it as malicious, and both PhishDestroy and ScamSniffer list it on their blocklists. The same domain appears on two additional security blocklists, and Gridinsoft assigned it a trust score of zero out of one hundred. The observed page title and the classification “Crypto Scam” together with the identified phishing kit “Airdrop Scam” suggest the operator was attempting to lure victims with a false airdrop promise, a common vector for cryptocurrency‑related fraud. The current offline status prevents further live interaction, but the infrastructure—particularly the use of Cloudflare’s edge network—remains reusable for future campaigns.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms employed, as no content beyond the page title has been captured. Defenders should continue to block the domain and its associated IP address at perimeter defenses, monitor for re‑registration of the same name or similar patterns, and incorporate the observed indicators (domain name, IP, page title, kit name, registrar, and blocklist entries) into threat‑intel feeds. Ongoing vigilance for additional domains using the same registrar or Cloudflare edge nodes is recommended.