litecoin-to-usdt[.]com

Analysis of litecoin-to-usdt.com, observed as offline at the time of the July 24 2026 assessment, indicates a high‑risk brand‑impersonation campaign targeting the Aave platform. The domain was registered on August 11 2025 through NiceNIC International Group Co., Limited and is hosted on Cloudflare’s network (AS13335) with the IP address 172.67.205.155 located in the United States. DNS resolution points to the Cloudflare name servers bill.ns.cloudflare.com and sima.ns.cloudflare.com, and the site does not present a valid SSL certificate, which is consistent with the observed lack of HTTPS support. The page title returned by the live endpoint before takedown reads “LTC to USDT (TRC20) — Fast No‑KYC Crypto Exchange | Convert Litecoin to Tether on TRON”, a typical lure for cryptocurrency conversion services. The domain is listed on four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—demonstrating that multiple threat‑intel feeds have flagged it.

VirusTotal scans show that ten of ninety‑five security vendors flagged the domain as malicious, reinforcing the suspicion of malicious intent. The Gridinsoft trust score of zero further confirms the low reputation of the host. The primary uncertainty concerns the exact payload delivered to victims, as the current offline state prevents direct inspection of any HTML, scripts, or credential‑phishing forms that may have been served. No additional indicators such as malicious binaries, command‑and‑control endpoints, or credential‑stealing URLs have been disclosed.

Consequently, defenders should assume that the domain was used to harvest Aave‑related credentials or to lure users into sending cryptocurrency to attacker‑controlled wallets.