usdtflow[.]fun

Analysis of the domain usdtflow.fun indicates it was involved in a generic phishing campaign classified as an Airdrop Scam. The domain was registered on February 21, 2026, through HOSTINGER operations, UAB, and resolved to the IP address 188.114.96.3, associated with AS13335 Cloudflare, Inc. in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (chase.ns.cloudflare.com and meg.ns.cloudflare.com), a common tactic to obscure hosting details and evade detection. No SSL certificate was present, increasing the likelihood of interception of unencrypted traffic. The domain's page title, 'Bot Verification,' suggests an attempt to deceive users into completing fraudulent verification processes, consistent with tactics observed in Airdrop Scams.

As of the report date, the domain appears on one security blocklist and is explicitly blocked by PhishDestroy. Detection engines on VirusTotal flagged the domain, with 2 out of 93 security vendors identifying it as malicious. The Gridinsoft trust score of 6/100 further corroborates its elevated risk level. The domain is currently offline, though its prior activity and infrastructure warrant continued monitoring.

Defenders should treat any residual DNS records or cached pages associated with usdtflow.fun as malicious. Organizations are advised to update blocklists with the domain and its resolving IP, and to investigate logs for connections to 188.114.96.3 during the period of its activity. Given the use of Cloudflare infrastructure, additional scrutiny of domains sharing the same nameservers may be prudent. The exact content and targeting of the phishing kit remain unconfirmed, but the classification as an Airdrop Scam aligns with known patterns of cryptocurrency-related fraud.