usdt-erc20[.]cryptobp[.]co

This domain, usdt-erc20.cryptobp.co, is flagged as an elevated-risk phishing threat targeting cryptocurrency users under the guise of USDT ERC-20 payment processing. Analysis indicates the domain operates as a generic_phishing site, specifically designed to deceive victims into submitting wallet credentials or transferring funds to attacker-controlled addresses. The page title "Kripto Ödeme" (Turkish for "Crypto Payment") suggests a focus on Turkish-speaking users or regions, though the infrastructure is globally accessible. Infrastructure analysis reveals the domain was registered on May 7, 2026, through NAMECHEAP INC, a registrar frequently abused for malicious activities. It resolves to the IP address 216.150.16.129 and employs a Let's Encrypt SSL certificate, providing a false sense of legitimacy. Detection metrics include 5/95 security vendors flagging the domain on VirusTotal and its presence on 1 security blocklist. The Gridinsoft trust score of 0/100 further confirms its malicious nature. Technologies detected on the site include Vercel for hosting and HTTP Strict Transport Security (HSTS), which may be leveraged to evade basic security checks. Mitigation steps for this threat type include immediate blocking of the domain and its resolving IP (216.150.16.129) at the network perimeter. Organizations should update endpoint protection rules to flag or quarantine any outbound connections to this domain. Cryptocurrency wallet providers and exchanges are advised to monitor for transactions referencing "Kripto Ödeme" or the domain name in payment notes. Users should be educated to verify payment requests through official channels only, particularly for ERC-20 transactions, and to cross-check domain registration dates (e.g., May 7, 2026, in this case) against legitimate service timelines. Incident responders should treat any interaction with this domain as a potential compromise of sensitive financial data.