loveusdtpay[.]us

The domain loveusdtpay.us was registered on February 21, 2026 through NameSilo, LLC and is currently resolved to the IP address 212.50.255.208, which belongs to AS25820 IT7 Networks Inc located in Japan. No TLS certificate is presented for the host, indicating that traffic is unencrypted. The page title returned by the server reads "Web3安全支付网关," suggesting a focus on Web3 payment services, but the content has not been publicly analyzed. Gridinsoft assigns a trust score of 0 out of 100, reflecting a complete lack of confidence in the site’s legitimacy.

The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal reports that two of ninety‑five scanning engines have flagged the domain, providing limited but notable detection evidence. Nameserver records point to ns1.dnsowl.com, ns2.dnsowl.com, and ns3.dnsowl.com, which are typical of domains hosted on shared DNS services. The domain is explicitly listed as impersonating the cryptocurrency exchange brand BitGet, aligning with a brand‑impersonation threat model.

Current operational status is offline, which may indicate takedown or temporary suspension. Defenders should update URL filtering and DNS blocklists to include loveusdtpay.us, monitor outbound connections to the associated IP range for any residual activity, and consider adding the domain to threat intelligence feeds. Additional scrutiny of any logs referencing the page title or the Japanese IP prefix is advised, as compromised credentials or malicious payloads could be delivered via the unencrypted endpoint before its takedown. Continuous observation of the hosting infrastructure and rapid re‑evaluation if the domain resurfaces are recommended to mitigate potential re‑use of the same infrastructure for future impersonation campaigns.