precousdt[.]com[.]br

On 21 February 2026 the domain precousdt.com.br was registered through a Gmail‑based account and delegated to the NSONE name server cluster (dns1.p06.nsone.net through dns4.p06.nsone.net). DNS resolution points to the single IPv4 address 35.157.26.135, which belongs to Amazon.com, Inc. (AS16509) and geolocates to Germany. The web service is hosted on Netlify and presents an HTTPS endpoint secured by a Let’s Encrypt certificate (issuer E7). HTTP response headers include HTTP Strict Transport Security (HSTS), indicating the site enforces TLS for future connections. The page title returned by the server is “Preço do USDT”, suggesting the site is intended to display a price for the USDT stablecoin, a common lure in cryptocurrency‑related phishing campaigns.

The domain currently appears on one public security blocklist and is actively blocked by the PhishDestroy feed. Independent scanning on VirusTotal recorded a single positive detection out of ninety‑three antivirus engines, confirming that at least one vendor has identified malicious behavior. The Gridinsoft trust score is 0 out of 100, reinforcing the classification of the host as untrustworthy. According to the risk assessment, the infrastructure is considered elevated, but the site has been taken offline at the time of this analysis.

No additional evidence such as login forms or payloads has been observed, and the exact phishing kit or dropper remains unknown. Defenders should continue to block precousdt.com.br at DNS and proxy layers, monitor the associated IP range for reuse, and add the domain to internal blocklists. Given the Netlify hosting, future re‑hosting of the same content under a new domain is plausible; therefore, threat‑intel teams should watch for similarly titled pages and reuse of the same SSL certificate fingerprint. Ongoing observation of the NSONE name servers for rapid domain turnover is also advised.