usdt[.]defi2016[.]vip

This domain, usdt.defi2016.vip, is identified as a crypto drainer targeting cryptocurrency wallet users. Analysis indicates the site masqueraded as a legitimate decentralized finance (DeFi) application, specifically using the 'Vite App' page title to deceive victims into connecting wallets. The infrastructure appears designed to execute unauthorized transactions, draining assets from compromised wallets via malicious smart contract interactions. No specific drainer kit variant was conclusively linked, but the domain's structure and naming convention align with known crypto theft campaigns. Infrastructure analysis reveals the following technical indicators: the domain was registered on April 07, 2026, through Gname.com Pte. Ltd. and resolves to the IP address 188.114.96.3. VirusTotal reports 5 out of 95 security vendors flagging the domain as malicious, while it appears on a single security blocklist. The SSL certificate is issued by Google Trust Services, which, while legitimate, is frequently exploited by threat actors to lend false credibility. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification. No detections were recorded in Google Safe Browsing (GSB) at the time of analysis. The domain is currently offline, reducing immediate risk of active exploitation. However, the elevated risk level persists due to the domain's recent creation date, low detection coverage, and the potential for reactivation. Response actions should include monitoring for re-registration or DNS changes, as well as alerting users who may have interacted with the domain prior to takedown. Organizations are advised to block the domain and associated IP at the network level, and to conduct retrospective analysis of logs for connections to 188.114.96.3. Wallet providers should flag transactions originating from this domain's seed (cdadb2) as high-risk and investigate for unauthorized access patterns.