usdt-buyer[.]duckdns[.]org

The domain usdt-buyer.duckdns.org has been identified as a crypto drainer scam targeting users under the guise of an institutional over-the-counter (OTC) trading desk for Tether (USDT). Analysis indicates this domain is designed to deceive victims into transferring cryptocurrency, which is then siphoned to attacker-controlled wallets. The domain is currently offline, but prior activity and infrastructure details confirm its malicious intent. Technical indicators reveal the domain was flagged by 12 of 95 security vendors on VirusTotal, with Google Safe Browsing specifically categorizing it as a social engineering threat. It resolved to the IP address 80.241.222.114 and was registered through DuckDNS, a dynamic DNS provider often abused for malicious purposes. The site was hosted on an Ubuntu server running Nginx, and it employed a Let's Encrypt SSL certificate to appear legitimate. Gridinsoft assigned a trust score of 0/100, and the domain appeared on at least one security blocklist. The page title, 'USDT Buyer — Institutional OTC Desk,' further supports the conclusion that it impersonated a legitimate trading service to exploit victims. Current status confirms the domain has been taken offline, but similar threats may reemerge under different domains or IPs. Users are advised to verify all cryptocurrency transaction destinations through official channels, avoid interacting with unsolicited OTC desk offers, and monitor wallet addresses for unauthorized transfers. Network administrators should block the IP 80.241.222.114 and any associated domains registered through DuckDNS with similar naming patterns. Cryptocurrency platforms should alert users to this specific scam vector and implement additional verification steps for high-value transactions.