usdttotrx[.]shop

Analysis indicates that usdttotrx.shop is an active cryptocurrency-themed phishing domain, registered on April 7, 2026, through GoDaddy.com LLC. The domain currently resolves to the IP address 82.112.239.11 and presents a 403 Forbidden page, suggesting either restricted access or infrastructure misconfiguration commonly associated with malicious operations. Infrastructure analysis reveals the domain is flagged on two security blocklists, including PhishDestroy and BLP-Malware, and holds a Gridinsoft trust score of 0/100, indicating a high-risk classification. Threat intelligence from AlienVault OTX links usdttotrx.shop to 23 distinct pulses, further corroborating its association with known malicious activity. While the exact content of the site remains unanalyzed, the domain name implies a focus on cryptocurrency transactions, specifically involving USDT (Tether) and TRX (TRON), a common vector for phishing schemes targeting digital asset holders. Security vendors have flagged the domain, though the specific detection count should not be interpreted as exhaustive due to potential variations in scanning coverage. Defenders are advised to treat this domain as hostile and implement blocking measures at the network and endpoint levels. Given its presence on multiple threat intelligence feeds and its low trust score, usdttotrx.shop should be considered an active threat until further evidence suggests otherwise. No legitimate use case has been identified, and the domain’s infrastructure aligns with patterns observed in prior cryptocurrency phishing campaigns.