makes-usdt0[.]top

PhishDestroy identifies makes-usdt0.top as an active USDT-draining phishing domain registered on April 28, 2026. The site is engineered to trick users into signing malicious transactions that silently drain USDT from connected wallets. No direct brand impersonation is visible in the seed data, but the domain’s naming pattern suggests a focus on USDT users. The drainer kit appears to rely on Let’s Encrypt SSL and a simple but effective fake “connect wallet” flow that requests dangerous transaction approvals once the victim is lured onto the page.

Technical indicators are consistent with a newly deployed phishing operation. VirusTotal shows 0 detections out of 95 engines, indicating the domain has not yet been widely flagged. The site resolves to IP 104.21.44.4 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain went live on April 28, 2026, and is already blocked by MetaMask and SEAL. It has appeared on two public blocklists, while Google Safe Browsing has not yet classified it as malicious.

Current status is active and under investigation, with a low but real risk of further victimization while the domain remains unblocked by major browsers. Immediate response actions include adding the domain to enterprise blocklists and alerting wallet extension providers. Remaining risk is moderate due to the zero-detection status and the drainer’s ability to bypass some defenses. Users should avoid interacting with makes-usdt0.top and scan connected wallets for unauthorized token approvals.