bep20[.]3124003124[.]com

This investigation documents the infrastructure and threat indicators associated with bep20.3124003124.com, a domain that has been identified as hosting a phishing page titled “Admin Transfer – USDT Escrow”. The domain was created on 28 February 2026 and is currently taken offline. DNS resolution points to the IP address 104.21.1.209, which belongs to Autonomous System 13335 operated by Cloudflare, Inc., and is geolocated in the United States. Both authoritative nameservers, daphne.ns.cloudflare.com and jonah.ns.cloudflare.com, are Cloudflare‑provided, confirming that the site leveraged Cloudflare’s CDN and DNS services.

Registration records show the domain was registered through Hostinger Operations, UAB, a known bulk‑registration provider, without an accompanying SSL/TLS certificate, indicating that the site was served over plain HTTP. Threat‑intelligence feeds have flagged the domain on two separate blocklists, specifically PhishDestroy and ScamSniffer, and VirusTotal reports indicate that three out of ninety‑three scanning engines have raised detections. The page title suggests an attempt to deceive victims into authorising transfers of USDT (Tether) under the pretext of an escrow admin operation, a common vector used to exfiltrate cryptocurrency assets. No additional content or visual evidence has been captured because the site is no longer reachable, leaving the exact payload and credential‑capture mechanisms unverified.

Defenders should incorporate the domain and its resolving IP address into perimeter‑blocking rules, update URL filtering lists, and monitor for any re‑registration or resurrection of the host. Given the reliance on Cloudflare’s infrastructure, threat‑hunting queries that target the specific nameserver pair and the AS13335 network may reveal related campaigns. Continuous observation of the registration entity (Hostinger Operations, UAB) for bulk‑registration patterns is advised.