usdt-23[.]com

This domain, usdt-23.com, is currently flagged as an active phishing site targeting cryptocurrency users, specifically those handling USDT transactions. Registered on December 7, 2025, through Gname.com Pte. Ltd., the domain presents a page titled 'Verification,' which suggests an attempt to deceive users into submitting sensitive information under the guise of a security or authentication process. Analysis indicates the site remains operational as of July 12, 2026, with no evidence of takedown or mitigation efforts. Infrastructure analysis reveals the domain resolves to IP address 172.67.143.114, a Cloudflare-protected endpoint that also supports HTTP/3 and jQuery, common technologies used to enhance phishing site functionality and evade detection. The domain appears on two security blocklists and is referenced in 23 threat intelligence pulses on AlienVault OTX, indicating widespread recognition of its malicious nature. Eight out of 95 security vendors on VirusTotal have flagged usdt-23.com, further corroborating its classification as a high-risk threat. While the exact content and mechanics of the phishing scheme are not yet analysed, the page title 'Verification' implies a focus on tricking users into disclosing credentials, private keys, or other sensitive data. The use of Cloudflare may obscure the true hosting origin, complicating attribution and takedown efforts. Defenders should treat this domain as hostile and prioritise blocking it at the network and endpoint levels. Security teams are advised to monitor for connections to 172.67.143.114 and review logs for any interactions with usdt-23.com, particularly in environments where cryptocurrency transactions are conducted. No legitimate verification process should originate from this domain.