usdt[.]6-i[.]cc

This domain, usdt.6-i.cc, is identified as a cryptocurrency credential theft operation designed to deceive users into disclosing wallet credentials or transferring funds to fraudulent accounts. The site masquerades as a legitimate virtual currency investment platform, using the Chinese title '虚拟货币投资平台' to target individuals interested in cryptocurrency trading. Analysis indicates the site employs social engineering tactics, such as fake login portals and investment dashboards, to harvest sensitive information or redirect victims to malicious smart contracts that drain wallet balances. Infrastructure analysis reveals multiple high-risk indicators confirming the domain's malicious nature. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd., an uncommon registrar for legitimate financial services. It resolves to the IP address 104.19.169.112 and is currently offline, though it remains flagged by 6 out of 95 security vendors on VirusTotal. The site employed Cloudflare for hosting, a common tactic to obscure server origins, and utilized Node.js with Express for backend operations, alongside HSTS to create a false sense of security. Additionally, the domain appears on one security blocklist and was previously blocked by automated phishing detection systems. Users who visited usdt.6-i.cc should take immediate action to mitigate potential risks. First, disconnect any devices used to access the site from the internet and run a full antivirus scan to detect malware or unauthorized scripts. If wallet credentials or private keys were entered, transfer remaining funds to a new, secure wallet and revoke any connected smart contract approvals. Monitor financial accounts and transaction histories for unauthorized activity, and report the incident to relevant cryptocurrency exchanges or fraud reporting platforms. Avoid interacting with any communications or links associated with this domain, as they may lead to further exploitation.