usdt[.]dapptot[.]top

The domain usdt.dapptot.top was registered on February 21, 2026 through Gname.com Pte. Ltd. and is currently flagged as active with a high risk rating. Intelligence classifies the site as a generic phishing operation targeting decentralized finance (DeFi) users, matching the listed scam type “DeFi Scam”. The page title returned by the web server is “Mining”, suggesting an attempt to lure victims with cryptocurrency‑related terminology.

Technical inspection shows the site resolves to two share‑dns name servers (a12.share-dns.com. and b12.share-dns.net.) and serves content over HTTP with a 200 response code. The underlying web server software is identified as Nginx and the response includes HTTP Strict Transport Security (HSTS) headers, indicating an effort to enforce HTTPS connections. No additional infrastructure details such as ASN or hosting provider are disclosed in the available data.

Detection platforms have recorded multiple signals of malicious activity. VirusTotal reports three out of ninety‑five scanners flagging the domain as malicious, and the site appears on a single security blocklist. The blocklist entry is also reflected in the Gridinsoft trust score of zero out of one hundred, and the domain is listed as blocked by the PhishDestroy mitigation service. These independent observations reinforce the high‑confidence assessment of phishing intent.

Defenders should prioritize immediate containment of traffic to usdt.dapptot.top. Network‑level firewalls and DNS filtering can be used to block both IPv4 and IPv6 resolutions of the domain, and any outbound connections to the identified name servers should be restricted. Continuous monitoring of newly created domains that share the same registrar or naming pattern is recommended to detect potential follow‑on campaigns. Incident responders should also consider gathering payload samples, if any, for deeper forensic analysis.