mr-usdt[.]club

PhishDestroy identifies an active cryptocurrency phishing campaign hosted at mr-usdt.club, an elevated-risk domain designed to impersonate USDT (Tether) services. The threat type is generic phishing, meaning attackers use social engineering and fake websites to harvest login credentials and digital wallet private keys. Victims who enter sensitive data risk immediate cryptocurrency theft and account takeover, with funds potentially laundered through privacy coins or mixers. Given the domain’s recent creation and low detection rate, this campaign poses a growing threat to cryptocurrency users seeking legitimate USDT services.

This domain was flagged by only 1 out of 95 VirusTotal security vendors, indicating extremely low detection coverage. It was registered through Dynadot Inc on February 28, 2026, and resolves to IP address 46.224.42.194. The domain uses a valid SSL certificate issued by Let’s Encrypt, enhancing its credibility to unsuspecting users. Low detection rates and recent registration suggest the campaign is either newly launched or deliberately avoiding well-known detection engines. There is no evidence of inclusion on major blocklists (e.g., Google Safe Browsing, PhishTank, OpenPhish) as of this report, which increases the risk of exposure. The registrar and hosting infrastructure do not immediately indicate prior malicious reputation, but the combination of recent creation, low detection, and cryptocurrency impersonation is highly suspicious.

To mitigate risk, cryptocurrency users should avoid accessing mr-usdt.club or any site prompting for USDT wallet credentials. Bookmark only official USDT websites (e.g., tether.to) and verify URLs carefully. Enable two-factor authentication (2FA) on all crypto accounts and use hardware wallets for storage. Report suspicious domains to security teams and cryptocurrency platforms. Block the IP 46.224.42.194 and domain mr-usdt.club at firewall and DNS levels. Educate users on recognizing social engineering tactics, including urgent language and fake login pages. Monitor crypto wallet addresses and accounts for unauthorized transactions. This campaign exemplifies the rising trend of cryptocurrency phishing using newly registered domains to evade detection and exploit trust in digital assets.