usdt[.]tb01[.]me

This domain, usdt.tb01.me, is actively flagged as a high-risk phishing infrastructure targeting users of USDT (Tether) payment systems. Analysis indicates the domain was registered on April 7, 2026, through a major registrar and currently resolves to the IP address 38.60.125.241. The page title, "USDT支付" (USDT Payment), suggests the site is designed to deceive users into submitting cryptocurrency transactions under false pretenses. The domain is blocked by at least two security blocklists, including PhishDestroy and BLP-Malware, and holds a Gridinsoft trust score of 0/100, reinforcing its malicious classification. Infrastructure review reveals the use of a Let's Encrypt SSL certificate, a common tactic among phishing operators to create a superficial appearance of legitimacy. While five of 95 security vendors on VirusTotal have flagged this domain, the absence of broader detection does not diminish its risk, as phishing domains often evade initial scans. No specific phishing kit or brand impersonation beyond the page title has been confirmed at this time. Defenders should treat this domain as an active threat. Immediate action includes blocking the domain and its resolving IP at the network level, as well as monitoring for related indicators of compromise, such as transaction requests or wallet addresses associated with the site. Given the domain's recent registration and ongoing activity, further investigation into its hosting provider and associated infrastructure is recommended to identify linked campaigns or additional malicious domains.