usdt-dreamcash[.]xyz

On July 24, 2026, the domain usdt-dreamcash.xyz was observed hosting a page with the title “Even geduld…”. The site was provisioned on March 03, 2026 through NiceNIC International Group Co., Limited and points to the Cloudflare edge address 104.21.11.226 (AS13335, United States). No TLS certificate is presented, indicating HTTP‑only service. Automated reputation services rate the page poorly; Gridinsoft assigned a trust score of 0 out of 100. VirusTotal recorded five positive detections out of ninety‑four scanned engines, and three independent blocklists (PhishDestroy, MetaMask, SEAL) have already listed the host.

The domain appears on three additional security blocklists, further confirming its malicious reputation. Nameserver configuration uses adam.ns.cloudflare.com and danica.ns.cloudflare.com, consistent with the Cloudflare hosting provider. The evidence points to a generic phishing operation, likely targeting users interested in cryptocurrency, as suggested by the “usdt” fragment in the domain name and the involvement of MetaMask in blocking. However, the exact luring technique, credential‑stealing form, or payload has not been captured because the site is currently offline. Consequently, the full scope of the campaign, including victim count and any associated command‑and‑control infrastructure, remains unknown.

Defenders should continue to block DNS resolution for usdt-dreamcash.xyz and add the host to internal URL filtering lists. Network monitoring should flag outbound connections to the IP 104.21.11.226, especially from browsers or wallets that may attempt TLS negotiation. Because the domain uses Cloudflare, any future re‑hosting on the same IP range could inherit the same risk; therefore, broader Cloudflare edge‑IP blocking or rate‑limiting may be warranted. Analysts are advised to watch for re‑registration of the domain or similar “usdt‑*” patterns and to share any newly observed indicators with threat‑sharing communities.