usdt-yk[.]netlify[.]app

Analysis of the domain usdt-yk.netlify.app indicates an active phishing campaign targeting cryptocurrency users, specifically those handling USDT (Tether) transactions. The domain, registered through Netlify on May 8, 2018, resolves to the IP address 63.176.8.218. As of July 29, 2026, this domain appears on two security blocklists, including PhishDestroy and ScamSniffer, which classify it as a phishing threat. VirusTotal reports that 3 out of 91 security vendors flag the domain, though the specific detection signatures or methodologies are not disclosed in the available data.

Infrastructure analysis reveals the domain is hosted on Netlify’s platform, a common choice for both legitimate and malicious campaigns due to its ease of deployment and free hosting services. The use of a subdomain under netlify.app may complicate takedown efforts, as Netlify’s abuse reporting processes often require additional verification for subdomain-based threats. The IP address 63.176.8.218 does not currently resolve to additional known malicious domains in public threat intelligence feeds, though this does not preclude its use in other campaigns. The exact content of the phishing page remains unanalyzed, as no page title, brand impersonation details, or phishing kit identifiers are provided.

However, the domain name itself suggests a focus on USDT-related scams, which typically involve fraudulent wallet requests, fake airdrops, or impersonation of cryptocurrency exchange services. Defenders should treat this domain as an elevated-risk threat, particularly in environments where cryptocurrency transactions are common. Organizations are advised to block the domain at the DNS or proxy level and monitor for related indicators of compromise, such as the resolving IP address. Further investigation into the domain’s hosting infrastructure and any associated email or wallet addresses may provide additional context for mitigation efforts.