scan-usdt[.]net

This domain, scan-usdt.net, is identified as a crypto wallet drainer phishing site designed to steal USDT and other cryptocurrency assets by deceiving users into connecting their wallets to malicious smart contracts. Analysis indicates the site employs social engineering tactics, such as fake token airdrops or wallet verification prompts, to trick victims into authorizing transactions that drain funds directly from their wallets. The threat specifically targets users of decentralized finance (DeFi) platforms and cryptocurrency holders who may be lured by fraudulent offers or urgent security alerts. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.97.3 and is flagged by 14 out of 95 security vendors on VirusTotal, including detections for phishing, malware distribution, and fraudulent transaction endpoints. Additionally, the domain appears on one security blocklist and has been included in a threat intelligence pulse on AlienVault OTX, further corroborating its malicious classification. The domain currently remains offline, though historical DNS records suggest it may have been part of a larger, coordinated phishing campaign. Users who visited scan-usdt.net or interacted with any content hosted on this domain should take immediate action to mitigate potential financial losses. First, revoke any active wallet authorizations or smart contract approvals granted to unknown or suspicious addresses using blockchain explorers or wallet management tools. Second, transfer all cryptocurrency assets to a new, secure wallet and monitor transaction histories for unauthorized activity. Third, scan all devices used to access the domain for malware, as phishing sites often deploy additional payloads to harvest credentials or maintain persistence. Finally, report the incident to relevant cybersecurity organizations and consider filing a complaint with local law enforcement or financial fraud authorities to aid in tracking and disrupting the threat actors.