usdt-16[.]com

Analysis of the domain usdt-16.com indicates it is actively involved in a high-risk crypto scam, specifically targeting users with a fraudulent verification process. Registered on December 7, 2025, through Gname.com Pte. Ltd., the domain resolves to the IP address 104.21.14.129, which is associated with AS13335 (Cloudflare, Inc.) and located in the United States. The domain's nameservers, julio.ns.cloudflare.com and marge.ns.cloudflare.com, further confirm its reliance on Cloudflare infrastructure, a common tactic to obscure hosting origins and evade takedowns. The domain is flagged by one security blocklist and has been assigned a trust score of 0/100, reflecting its confirmed malicious status. While the HTTP status currently returns a 403 Forbidden response, the page title 'Verification' suggests it may be designed to impersonate a legitimate cryptocurrency verification or authentication portal. The SSL certificate, issued by Google Trust Services (WE1), provides a superficial layer of legitimacy but does not mitigate the underlying threat. Detection data from security vendors indicates that 9 out of 95 engines classify this domain as malicious, though the specific nature of the threat—beyond its categorization as a crypto scam—remains partially unverified due to limited visibility into its operational content. Technologies detected on the domain include jQuery, Cloudflare Browser Insights, and HTTP/3, which are consistent with modern web infrastructure but do not provide definitive evidence of the scam's mechanics. Defenders should treat this domain as an active threat, particularly in environments where cryptocurrency transactions or user verification processes occur. Blocking the domain at the DNS or network level is recommended, along with monitoring for related infrastructure, such as additional domains registered through the same registrar or resolving to the same IP range.