getflashusdt[.]com

The domain getflashusdt.com was observed hosting a page titled “Flash USDT TRC20”. The site was registered on February 21, 2026 through HOSTINGER operations, UAB and is served from the Hostinger International Limited network (AS47583) at IP 147.79.120.114, geolocated to the United States. DNS resolution uses the parking nameservers ns1.dns-parking.com and ns2.dns-parking.com. The certificate presented is a Let’s Encrypt R13 TLS certificate, indicating a valid HTTPS endpoint. Traffic analysis shows the site employed Hostinger CDN, the Hostinger web stack, Google Analytics tracking, and HTTP/3 protocol support.

VirusTotal scans recorded four positive detections out of ninety‑three vendor engines, confirming malicious classification by multiple security products. The domain is listed on one public security blocklist and has been actively blocked by the PhishDestroy filtering service. No additional blocklist references were provided. The site’s current HTTP status is offline, as indicated by the “taken offline” status in the intelligence feed.

Evidence points to a generic phishing operation targeting cryptocurrency users, specifically promoting a USDT TRC20 transaction. The precise content of the landing page has not been captured, so the exact phishing vector remains unknown. Defenders should continue to block the domain at network perimeter filters, update URL filtering lists, and monitor for any resurgence of the IP address or associated hosting infrastructure. Because the domain uses a legitimate certificate and a reputable hosting provider, passive DNS and certificate monitoring are recommended to detect potential re‑registration or reuse of the same infrastructure for future campaigns.