pay-usdt[.]netlify[.]app

Analysis of the domain pay-usdt.netlify.app indicates it was actively involved in a crypto scam impersonating Trust Wallet, a known cryptocurrency wallet service. The domain was registered on February 22, 2026, through Name.com, Inc., and hosted on Netlify infrastructure. Infrastructure analysis reveals the site resolved to IP address 18.208.88.157, located in Germany under Amazon.com, Inc.'s AS16509. The SSL certificate was issued by DigiCert Inc, specifically the DigiCert Global G2 TLS RSA SHA256 2020 CA1, which is consistent with legitimate hosting environments but does not preclude malicious use.

The page title, 'Transfer Trust Wallet,' directly aligns with the reported scam type, suggesting the site was designed to deceive users into transferring cryptocurrency under false pretenses. At the time of this report, the domain returns an HTTP 404 status, indicating it is no longer serving content, though this does not confirm permanent takedown. Detection data shows the domain was flagged by at least two security blocklists and identified by one of 95 security vendors on VirusTotal as malicious. Additional scrutiny from PhishDestroy and ScamSniffer further corroborates its classification as a phishing threat.

Defenders should note that while the domain is currently offline, its infrastructure and registration details remain relevant for retrospective threat hunting. The use of Netlify, a legitimate hosting provider, is a common tactic to evade initial suspicion. Organizations are advised to monitor for related domains registered through the same registrar or resolving to the same IP range, particularly those mimicking cryptocurrency services. No further content analysis is available at this time, as the site is no longer accessible for inspection.