usdt[.]bictu[.]vip

Analysis of the domain usdt.bictu.vip indicates it was actively involved in wallet and seed phrase phishing targeting Binance users. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd. and resolved to the IP address 193.218.201.183, hosted under AS201106 (Spartan Host Ltd) in the United States. The SSL certificate was issued by 宝塔面板 (Baota Panel), a common control panel used in web hosting environments, which may suggest automated or bulk deployment of phishing infrastructure. The domain was flagged by two out of 93 security vendors on VirusTotal and appeared on one security blocklist. The page title, 'Mining,' does not directly reference Binance but aligns with common cryptocurrency-related phishing themes.

The scam type is classified as Wallet/Seed Phishing, and the phishing kit used is identified as 'Wallet Connect Abuse,' indicating an attempt to exploit wallet connection protocols to harvest credentials or seed phrases. The domain was blocked by PhishDestroy and is currently offline as of the report date. Infrastructure analysis reveals the use of nameservers b4.share-dns.net and a4.share-dns.com, which have been associated with other malicious domains in the past. The Gridinsoft trust score of 0/100 further supports the assessment of malicious intent.

While the exact content of the phishing page is not confirmed, the combination of brand impersonation, phishing kit identification, and low detection vendor coverage suggests a targeted campaign aimed at cryptocurrency users. Defenders should treat this domain as confirmed malicious and ensure it is blocked at the network and endpoint levels. Monitoring for similar domains using the same nameservers, hosting provider, or SSL issuer may help identify related threats. No further activity is expected from this domain given its offline status, but retrospective analysis of logs for connections to 193.218.201.183 or usdt.bictu.vip is recommended to assess potential exposure.