usdtmixer[.]shop

The domain usdtmixer.shop is currently active and classified as a generic_phishing threat with a high risk rating. Infrastructure analysis shows the domain is hosted on the DNS provider dnspod.com, using the authoritative nameservers a.dnspod.com, b.dnspod.com, and c.dnspod.com. DNS resolution points to the IPv4 address 158.94.211.169, which is the sole IP observed for this indicator. VirusTotal has recorded detections from three of ninety‑one security vendors, confirming that a minority of scanners have identified malicious behavior associated with the domain. The limited detection count suggests that some security products have not yet flagged the site, but the presence of any detections reinforces the high‑risk assessment. No additional context such as page content, target brand, or specific phishing kit is available, leaving the exact payload or credential‑harvesting mechanism uncertain. Defenders should block network traffic to usdtmixer.shop and its associated IP address, monitor DNS queries for the listed dnspod.com nameservers, and incorporate the domain into threat‑intel feeds. Continuous re‑evaluation is recommended as additional detections may emerge, and any observed credential submissions or malware downloads should be correlated with this indicator to confirm the phishing campaign’s scope.