flashusdt[.]cloud

On 24 July 2026, analysts examined flashusdt.cloud, a domain created on 21 February 2026 and registered through Hostinger Operations UAB. The site presented the page title “Flash USDT – Fast & Secure Flash Transfers,” suggesting a cryptocurrency‑related lure. Technical fingerprinting shows the domain resolves to IP 82.180.142.127, located in India and belonging to AS47583 (Hostinger International Limited). The hosting infrastructure leverages LiteSpeed web server behind Cloudflare, serves content over HTTP/3, and incorporates PHP, Bootstrap, jsDelivr, cdnjs and other common libraries. The SSL certificate is issued by Let’s Encrypt (R12), providing TLS encryption but offering no additional trust signals.

Reputation data indicate the domain is currently offline and has been taken down from public access. It is listed on a single security blocklist and is actively blocked by PhishDestroy. Gridinsoft assigned a trust score of 0 out of 100, reflecting extreme suspicion. VirusTotal scanned the domain and two of ninety‑three vendors flagged it as malicious, reinforcing the phishing classification. The domain uses generic parking nameservers ns1.dns-parking.com and ns2.dns-parking.com, a pattern often observed in rapidly deployed abuse sites.

While the page content has not been captured, the combination of a cryptocurrency‑focused title, recent registration, low‑reputation hosting, and multiple independent detections strongly supports a phishing intent aimed at extracting USDT or other digital assets. Uncertainty remains regarding the exact payload or credential‑harvesting mechanism, as no screenshots or form details are available. Defenders should continue to block flashusdt.cloud at perimeter and DNS layers, monitor for any re‑hosting attempts, and add the domain to internal threat‑intel feeds. Additional scrutiny of traffic to the associated IP and Cloudflare edge nodes is advised, as attackers may shift to new domains using the same infrastructure.