usdt920[.]com

This domain is flagged as a confirmed cryptocurrency investment phishing site targeting users with fraudulent blockchain financial schemes. Analysis indicates the infrastructure was specifically designed to impersonate legitimate cryptocurrency investment platforms, luring victims with promises of financial freedom and high-return opportunities. The threat type falls under targeted financial phishing, with a focus on cryptocurrency theft and credential harvesting. Infrastructure analysis reveals multiple high-risk indicators. The domain resolves to IP address 188.114.96.3 and was registered through Gname.com Pte. Ltd. on February 21, 2026. Security vendors on VirusTotal flagged the domain at a rate of 9/95, while Gridinsoft assigned a trust score of 0/100. The domain appears on two security blocklists, including PhishDestroy and OISD. Detected technologies include Vue.js, HSTS, Cloudflare Browser Insights, Cloudflare, and HTTP/3, with an SSL certificate issued by Google Trust Services. The page title, 'Blockchain Investment Project Website - Unlock Financial Freedom,' aligns with common phishing tactics used to exploit cryptocurrency enthusiasts. Mitigation steps for this specific threat type include immediate blocking of the domain and its associated IP address across all network security controls. Organizations should update endpoint protection rules to detect and prevent access to similar cryptocurrency-themed phishing domains. Users should be educated on recognizing fraudulent investment schemes, particularly those promising unrealistic returns or using urgent language to prompt action. Financial institutions and cryptocurrency platforms should monitor for credential reuse attempts originating from this domain's infrastructure. Given the domain's current offline status, continuous monitoring for re-emergence or similar variants is recommended.