usdt-staking[.]ltd

The domain usdt-staking.ltd was registered on February 21, 2026 through Namemart Limited and is currently taken offline. DNS resolution points to the IP address 188.114.96.3, which belongs to the AS13335 Cloudflare network and is geolocated in the United States. The domain lacks an SSL certificate, and its nameservers are listed as tina.ns.cloudflare.com and vick.ns.cloudflare.com, indicating reliance on Cloudflare’s DNS infrastructure. A Gridinsoft trust score of 0 out of 100 further underscores the malicious nature of the site.

Reputation services have flagged the domain: fifteen of ninety‑three security vendors on VirusTotal reported it as malicious, and it appears on a single security blocklist. PhishDestroy has explicitly blocked the domain, and the site is categorized as a credential‑phishing campaign targeting Google users, as indicated by the brand impersonation field and the page title "USDT-STAKING". The evidence suggests the operator attempted to lure victims with a crypto‑related lure while harvesting Google credentials. Uncertainty remains regarding the exact phishing page content and any additional payloads, as no screenshots or content analysis are available.

Defenders should proactively block DNS resolution for usdt-staking.ltd and its associated IP address 188.114.96.3 at network perimeter devices, update URL filtering rules to include the domain, and monitor for any outbound traffic to Cloudflare‑hosted endpoints that reference the domain. Incident response teams should also inspect logs for any authentication attempts to Google services that originated from the same client IPs, and consider user education campaigns that highlight the mismatch between the domain name and legitimate Google services. Continuous monitoring of threat intelligence feeds for re‑use of the same registrar, nameservers, or IP range will help detect future campaigns that reuse this infrastructure.