eth-to-usdt[.]com

PhishDestroy identifies eth-to-usdt.com as an active crypto drainer scam registered on August 04, 2025. The domain mimics legitimate Ethereum-to-Tether conversion services to trick users into approving malicious token transfers. No evidence of a branded impersonation kit (e.g., MetaMask, Ledger) was detected in open-source feeds, suggesting a generic drainer targeting EVM wallets. The infrastructure leverages a simple but effective lure: promising quick USDT conversions from ETH deposits, which aligns with common drainer tactics observed in campaigns tracked during Q3 2025.

Technical indicators confirm elevated risk. The domain resolves to IP 104.21.94.152 and is served via a valid SSL certificate issued by Google Trust Services. NICENIC INTERNATIONAL GROUP CO., LIMITED registered the domain just days ago, and only 2 out of 95 VirusTotal security vendors currently flag it—indicating a fresh but under-detected threat. There is no public record of this domain on Google Safe Browsing (GSB) lists, and its low detection rate suggests it may be actively evading blocklists through rapid infrastructure cycling.

As of seed 405a64, this domain remains active and unresolved. Immediate containment is recommended via DNS sinkholing, browser blocklist updates, and endpoint protection rules targeting the IP and domain. Despite low VT coverage, the combination of recent registration, clean SSL, and crypto drainer behavior elevates its threat level due to potential financial impact. Users should avoid visiting the site and report any interaction to their security teams. Remaining risk is moderate-high, with potential for rapid expansion if undetected. Monitor for new subdomains or related drainer variants under the same registrar or IP space.