usdt-eth11[.]com

This domain, usdt-eth11.com, is actively flagged as a high-risk phishing site targeting cryptocurrency users. Registered on December 7, 2025, through Gname.com Pte. Ltd., it currently resolves to the IP address 104.21.24.213. The domain appears on two security blocklists and is recognized in 24 threat intelligence pulses within AlienVault OTX, indicating widespread detection across multiple security communities. Analysis of its infrastructure reveals the use of Cloudflare services, including Cloudflare Browser Insights and HTTP/3, alongside jQuery for client-side scripting, which are common in phishing sites to enhance performance and evade detection. The page title, 'Verification,' suggests an attempt to mimic legitimate cryptocurrency verification processes, though the exact content and targeted brand remain unconfirmed due to lack of direct analysis. The domain is flagged by two out of 95 security vendors on VirusTotal, a relatively low detection rate that may reflect evasion techniques or recent deployment. The SSL certificate issued by Google Trust Services provides a veneer of legitimacy, which is frequently exploited in phishing campaigns to deceive users into trusting the site. Defenders should treat this domain as an active threat, particularly in environments where cryptocurrency transactions or wallet verifications occur. The use of Cloudflare infrastructure complicates traditional IP-based blocking, necessitating domain-level or DNS-based mitigation strategies. Given its presence on multiple blocklists and in threat intelligence feeds, organizations are advised to proactively block access to usdt-eth11.com and monitor for related indicators of compromise, such as unusual outbound connections to 104.21.24.213 or associated domains registered through the same provider. Further investigation into the site's backend or hosting patterns may reveal additional linked infrastructure.