usdt[.]fhxusd[.]bar

PhishDestroy identifies an active phishing campaign targeting cryptocurrency users through the domain usdt.fhxusd.bar, which impersonates a legitimate USDT wallet service to harvest login credentials and private keys. This domain was flagged after security researchers observed its deployment in spam emails and social media posts promoting fake USDT giveaways and wallet access portals. The threat actor leverages social engineering to trick victims into entering sensitive wallet information, with the ultimate goal of draining cryptocurrency assets directly from connected wallets. This domain poses a critical risk due to its low detection rate and recent infrastructure setup. VirusTotal currently shows 4 out of 95 security engines flagging the domain, indicating it remains under the radar of most antivirus and threat intelligence platforms. The domain is registered through GoDaddy and was created on February 14, 2026, demonstrating its recency. It resolves to IP address 45.207.197.54 and uses a SSL certificate issued by TrustAsia Technologies, Inc., a certificate authority known to be abused in phishing operations. The domain has not yet been added to major blocklists, further increasing its potential reach and effectiveness in phishing campaigns. Users who have visited this domain should immediately check their cryptocurrency wallets for unauthorized transactions and revoke any permissions granted to connected applications. Do not enter any credentials or private keys into this site. If you entered sensitive information, transfer remaining funds to a new wallet and enable two-factor authentication. Report the domain to your antivirus provider and block it using your network security tools. Monitor financial accounts closely for suspicious activity and consider using hardware wallets for enhanced security. This domain should be treated as hostile and avoided entirely.