pay-for-usdt-trc20-000485[.]pages[.]dev

This domain, pay-for-usdt-trc20-000485.pages.dev, is flagged as an active crypto drainer infrastructure designed to siphon USDT (TRC-20) tokens from unsuspecting users. Analysis indicates the site employs no overt brand impersonation but instead relies on deceptive transaction prompts and wallet interaction requests to trigger unauthorized transfers. No known drainer kit signatures have been identified yet, though behavioral patterns align with automated token-drain scripts observed in prior campaigns. Infrastructure analysis reveals the domain is hosted on Cloudflare Pages, a platform frequently exploited for low-cost, disposable phishing deployments. The domain was registered on May 27, 2026, and remains undetected by VirusTotal (0/95 engines), suggesting either evasion techniques or recent deployment. It appears on a single security blocklist, indicating limited but growing awareness. No Google Safe Browsing (GSB) flags are present, and no associated IP address has been publicly attributed due to Cloudflare’s proxy obfuscation. The absence of prior detections and minimal blocklist presence suggest this is an emerging or carefully managed threat. Current status remains active, with no takedown or suspension observed as of this assessment. The domain has been preemptively blocked by at least one security provider, though broader detection coverage is lacking. Remaining risk is elevated due to the combination of zero detections, active hosting, and direct targeting of cryptocurrency assets. Users are advised to verify wallet addresses independently, avoid interacting with unsolicited transaction prompts, and monitor for unauthorized token movements. Wallet providers and security teams should prioritize monitoring for interactions with this domain, particularly in TRC-20 transaction contexts.