usdtduihuan[.]com[.]cn

This domain, usdtduihuan.com.cn, is flagged as a cryptocurrency exchange phishing site targeting users of Tether (USDT) transactions. The page title, "USDT兑换 - 安全便捷的泰达币兑换平台 | 实时汇率 | 低手续费," suggests impersonation of a legitimate USDT exchange platform, likely aiming to harvest credentials or facilitate fraudulent transactions. No specific drainer kit signatures have been identified at this stage, but the domain exhibits characteristics consistent with cryptocurrency-themed phishing infrastructure, including the use of terms like "实时汇率" (real-time exchange rate) and "低手续费" (low fees) to lure victims. Analysis indicates the domain was registered on April 7, 2026, through 广东时代互联科技有限公司, a registrar commonly associated with high-risk domains. It resolves to the IP address 160.124.188.102, which has not been widely flagged in public threat intelligence feeds. VirusTotal reports 0/95 detections, suggesting the domain has not yet been broadly recognized as malicious by security vendors. However, it appears on one security blocklist (PhishDestroy) and has a Gridinsoft trust score of 0/100, reinforcing its classification as high-risk. The SSL certificate is issued by Let's Encrypt, a common tactic to lend superficial legitimacy to phishing sites. As of the latest assessment, usdtduihuan.com.cn has been taken offline, likely in response to detection by security systems. However, the domain remains registered, and there is a residual risk of re-activation or migration to a new host. Users who interacted with the site prior to its takedown should assume potential exposure of credentials or transaction details. Organizations are advised to block the domain and associated IP (160.124.188.102) at the network level. Cryptocurrency users should verify exchange platforms through official channels and enable multi-factor authentication to mitigate risks from similar phishing attempts.