usdt[.]dappout[.]vip

Analysis of the domain usdt.dappout.vip indicates active malicious activity consistent with an investment‑type phishing campaign. The domain was registered on February 21, 2026 through Gname.com Pte. Ltd. and resolves to the Cloudflare‑owned address 172.67.215.189, which is geolocated to Canada. DNS resolution is serviced by the Cloudflare nameservers cosmin.ns.cloudflare.com and betty.ns.cloudflare.com, and the site employs Cloudflare security features including HSTS, Cloudflare Browser Insights, and HTTP/3. The page title observed on the site is "Mining," which aligns with the investment‑scam narrative often used to lure victims into cryptocurrency‑related schemes.

Security‑grade assessments are uniformly negative: Gridinsoft assigns a trust score of 0 / 100, the domain appears on a single security blocklist, and PhishDestroy has explicitly blocked it. VirusTotal scanning reports that one of ninety‑five security vendors flagged the domain, reinforcing the suspicion of malicious intent. The risk level is classified as elevated and the infrastructure remains active as of the report date, July 22, 2026.

While the specific payload or credential‑harvesting page content has not been publicly disclosed, the convergence of low trust scores, blocklist entries, and a flagged VirusTotal result suggests a high probability of phishing or credential‑stealing operations targeting investors. Defenders should block network traffic to the IP address 172.67.215.189, add the domain to URL filtering policies, and monitor for any outbound connections from internal hosts to the Cloudflare edge. Continuous re‑scanning with multi‑engine services is advised to detect any evolution of the payload, and any observed attempts to engage the domain should be logged and investigated as potential compromise attempts.