usdtsend[.]li

The domain usdtsend.li is identified as a brand impersonation threat specifically targeting Trust Wallet, a cryptocurrency wallet service. Analysis indicates this infrastructure was designed to deceive users into interacting with a fraudulent interface, likely functioning as a crypto drainer to siphon digital assets. The domain is currently offline, though prior activity suggests malicious intent. Infrastructure analysis reveals the domain was flagged by 3 of 95 security vendors on VirusTotal, indicating detection by multiple threat intelligence sources. It resolved to the IP address 216.198.79.1 and was hosted on Vercel, a platform often exploited for rapid deployment of phishing pages. The page title explicitly mimicked Trust Wallet, reinforcing the brand impersonation tactic. Additional technical indicators include the use of a Let’s Encrypt SSL certificate and HTTP Strict Transport Security (HSTS) headers, which may have been employed to appear legitimate. The domain appeared on at least one security blocklist, and its trust score was rated 0/100 by Gridinsoft, further confirming its malicious classification. Given the domain’s current offline status, immediate interaction risks are mitigated. However, users who previously visited or engaged with usdtsend.li should assume potential exposure. Recommended actions include revoking any connected wallet permissions, monitoring for unauthorized transactions, and verifying official communication channels for Trust Wallet. Organizations should update blocklists to include this domain and its associated IP address to prevent future access attempts. Continuous monitoring of similar infrastructure patterns is advised, as threat actors frequently reuse tactics across new domains.