usdt[.]minefreee[.]cc

Analysis of the domain usdt.minefreee.cc shows a newly registered host (creation date February 21, 2026) that was taken offline shortly after deployment. The site presented the page title "MINEFREEE USDT - Multi-Crypto Cloud Mining Platform" and is classified as a brand impersonation campaign targeting the TON ecosystem. Registration was performed through Dynadot LLC, and the domain resolves to the Cloudflare address 104.21.4.39, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. No TLS certificate was observed, indicating that the site operated without HTTPS protection.

The domain is listed on a single security blocklist and carries a Gridinsoft trust score of 0 out of 100, reflecting an extremely low reputation. VirusTotal scans reported 13 detections out of 95 security vendors, confirming that multiple anti‑malware engines flag the host as malicious. The authoritative nameservers are barbara.ns.cloudflare.com and west.ns.cloudflare.com, consistent with the Cloudflare hosting infrastructure. PhishDestroy has also blocked the domain, reinforcing its malicious status.

While the page content has not been publicly examined, the combination of brand impersonation labeling, low trust metrics, multiple vendor detections, and blocklist presence provides strong evidence of a phishing or fraud operation. Defenders should immediately add usdt.minefreee.cc and its resolving IP 104.21.4.39 to network deny lists, monitor for any residual traffic, and verify that endpoint protection solutions are updated to include the reported VirusTotal detections. Ongoing observation of Cloudflare‑hosted assets associated with this IP is advised, as threat actors may reuse the same infrastructure for future campaigns.