usdart[.]la

usdart.la was registered on February 21, 2026 through Key-Systems GmbH. The domain is currently active and serves a page titled “REWARD Portal v2- Latest Web3 Wallets”. The site is classified as a brand impersonation targeting Metamask and is associated with the wallet_connect_phish scam type. Risk level is high. Technical profiling shows the domain resolves to IP 209.94.90.1, which is announced by AS40680 (Protocol Labs) and geolocated to the United States. The name servers are COEN.NS.CLOUDFLARE.COM and TIA.NS.CLOUDFLARE.COM, indicating the use of Cloudflare’s reverse‑proxy service. The service presents an SSL certificate issued by Google Trust Services under the WE1 identifier and supports HTTP/3. An HTTP request returns status 403, suggesting content is restricted or behind a gate. Threat intelligence indicates the domain is blocked by PhishDestroy and appears on one external blocklist. VirusTotal analysis shows 4 out of 95 security vendors have flagged the domain, and Gridinsoft assigns a trust score of 8 out of 100, both pointing to malicious intent. The combination of Metamask impersonation, the reward‑portal title, and the wallet_connect_phish tag aligns with known credential‑harvesting campaigns that lure users into connecting malicious wallet‑connect endpoints. Defenders should add usdart.la to block lists at network perimeter and endpoint controls, monitor DNS queries for the domain and its Cloudflare name servers, and enforce strict validation of wallet‑connect URIs in client applications. Continuous scanning of the IP address 209.94.90.1 for new services is recommended, as the hosting infrastructure could be reused for additional phishing sites. Incident response teams should treat any authentication attempts to this domain as compromised and advise affected users to revoke any tokens or approvals that may have been granted.