sendusdt00.netlify.app is an impersonation phishing page. Its name poses as a tool for sending USDT, which targets people who hold or transfer Tether stablecoins from their crypto wallets. PhishDestroy first flagged it on 2026-09-12. The site has been offline since 2026-09-20 and was still dead when last checked on 2026-10-19.
How the scam works
Pages built around a "send USDT" theme usually copy the look of a wallet or transfer interface. They ask the visitor to connect a wallet, sign a transaction or token approval, or type in a recovery phrase to "verify" the transfer. Any one of these hands the attacker control of the stablecoins, and with a seed phrase, control of the whole wallet. The page now shows only a generic "Site not found" title with no content at its root. That is a hosting error page, while our impersonation classification reflects the page's earlier behavior.
Evidence
This is not a single-source verdict. On 2026-09-21, 18 of 89 VirusTotal engines flagged the address. Among them were BitDefender, ESET, Fortinet, Forcepoint ThreatSeeker, Emsisoft, alphaMountain.ai, CyRadar and Ermes. That is a solid detection count for a short-lived free-hosting subdomain. ScamSniffer, a blocklist focused on wallet scams, lists it alongside PhishDestroy.
Infrastructure
The operator did not register a domain. They used a free Netlify subdomain, a common choice for throwaway phishing pages because it costs nothing and can go live in minutes. The site was served from Amazon cloud infrastructure in Germany, which belongs to Netlify's own hosting. It carried Netlify's standard DigiCert certificate, so the browser padlock said nothing about whether the site was legitimate. It went offline eight days after we first saw it.
What to do
If you connected a wallet to this page, check your token approvals in a revocation tool or block explorer. Revoke any USDT allowances or other permissions you do not recognize. If you entered a recovery phrase, treat that wallet as compromised and move your remaining funds to a new wallet with a fresh seed right away. Only send USDT through your wallet's own app, never through a website that asks you to connect or verify. Security teams should block the netlify.app subdomain rather than the parent platform and watch for similar "sendusdt" naming on other free hosts.
Certificate fingerprintbc3a8134c21a842e64ea34d488826dd2ba50f59a3bcbaed1e6b71a4242de1478Certificate names · 1 SANs
netlify.app
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Wallet-drainer collection address observed in the JavaScript of 1 phishing site: sendusdt00.netlify.app. The page impersonates Trust Wallet.
The page prompts a victim to connect a wallet and sign a transfer or approval to this address rather than harvesting credentials. The addr
Check for cloaking
Compare what a browser and a crawler receive, and check for Keitaro traffic routing.
1 report filed for sendusdt00.netlify.app (1 written by a person) · category: Phishing · source checked
“Wallet-drainer collection address observed in the JavaScript of 1 phishing site: sendusdt00.netlify.app. The page impersonates Trust Wallet.
The page prompts a victim to connect a wallet and sign a transfer or approval to this address rather than harvesting credentials. The address was extracted from a destination context (transfer target / approval operator) in the page's script bundle, not merely referenced.
Verified as an externally-owned account (not a contract) via eth_getCode across 6 EV”
— reported by Anonymous on Sep 15, 2026 · Source: ChainAbuse (TRM Labs) — full report and evidence there.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(US)
