usdlt0-to[.]us

Analysis of the domain usdlt0-to.us shows it was registered on February 21, 2026 through Web Commerce Communications Limited and currently resolves to the Cloudflare address 172.67.138.157, which is located in the United States and associated with AS13335 Cloudflare, Inc. The authoritative nameservers bob.ns.cloudflare.com and tia.ns.cloudflare.com confirm that the domain is served behind Cloudflare’s edge network and is configured to use HTTP/3. An SSL certificate issued by Google Trust Services under the WE1 umbrella is present, indicating a valid TLS handshake, but the site returns HTTP status 523, a Cloudflare-specific error that signals the origin server is unreachable, consistent with the reported offline status. The page title returned from the host is "usdt0.to," a typo‑variant of a common cryptocurrency moniker, yet no additional page content has been captured.

Reputation signals are strongly negative: the domain appears on three security blocklists, has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, and received a single detection out of 93 vendors on VirusTotal. Furthermore, Gridinsoft assigns a trust score of 0 out of 100, reinforcing the elevated risk assessment. While the underlying IP is shared with many legitimate sites, the convergence of blocklist listings, low trust scoring, and the presence of a phishing‑related block by MetaMask suggests the domain is being leveraged for crypto‑focused malicious campaigns.

Uncertainty remains regarding the exact payload or user‑interaction flow because the site is currently offline and no forensic capture of the landing page exists. Defenders should immediately add usdlt0-to.us to network‑level deny lists, ensure URL filtering solutions block access, and monitor for any resurrection of the domain or related subdomains.