usdt-gateway[.]com

usdt-gateway.com was registered through NameCheap, Inc. on October 08, 2025. The domain resolves to the IP address 172.67.152.22, which belongs to AS13335 operated by Cloudflare, Inc. and is geolocated in the United States. An SSL certificate identified as WE1 is presented for the site, indicating the use of HTTPS. The page title returned from the host is “USDT Payments - 글로벌 암호화폐 결제 솔루션”, which references a cryptocurrency payment solution and aligns with the listed scam type of “Crypto Scam”.

The domain explicitly impersonates the Binance brand, as recorded in the intelligence feed. Reputation services assign extremely low confidence scores: Gridinsoft rates the domain 0/100 and Scamadviser assigns a trust score of 1/100, both indicating a high likelihood of malicious intent. VirusTotal scans show that 2 of 93 security vendors have flagged the domain, and the host appears on a single external blocklist. Independent monitoring by PhishDestroy has already blocked the domain, and the current operational status is offline.

Analysis confirms that the infrastructure leverages a reputable CDN provider (Cloudflare) to mask the true location of the malicious server, a common tactic in crypto‑related impersonation campaigns. The combination of a newly created domain, poor trust metrics, targeted brand labeling, and detection by multiple vendors substantiates an elevated risk profile. Defenders should add the domain and its associated IP address to internal blocklists, monitor DNS queries for similar NameCheap‑registered domains pointing to Cloudflare AS13335, and enforce strict verification of any unsolicited Binance‑related communications. Continuous review of threat‑intel feeds for new indicators of compromise related to this campaign is recommended.