usdt0.cfd – High‑Risk Ethereum Wallet Seed Phishing Site

Analysis of the domain usdt0.cfd, created on 21 February 2026 and hosted behind Cloudflare (AS13335) at IP 104.21.39.108, indicates an active high‑risk infrastructure aimed at harvesting Ethereum wallet seeds. The site presents the page title “XAUT & USDT0 — Secure Transfer & Buy Portal | Digital Gold Exchange”, which is consistent with a cryptocurrency‑focused lure. The SSL certificate is issued by Google Trust Services under the WE1 designation, confirming a valid TLS chain but offering no indication of legitimacy. The HTTP response is 403, suggesting access restrictions that may be used to hide malicious content from casual browsers while serving targeted victims.

Cloudflare‑provided security headers such as HSTS and support for HTTP/3 are observed, typical of legitimate services and thus helping the actor blend in. Reputation checks show a Gridinsoft trust score of 0/100 and the domain appears on four security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. VirusTotal scans report three of ninety‑three AV engines flagging the domain, reinforcing the malicious classification despite the low detection ratio. Registration details point to Global Domain Group LLC as the registrar, with nameservers bailey.ns.cloudflare.com and rory.ns.cloudflare.com, both owned by Cloudflare, which further obscures attribution.

While the exact landing page content has not been publicly disclosed, the combination of brand targeting (Ethereum), the declared scam type (wallet/seed phishing), and the observed infrastructure strongly suggests a credential‑harvesting operation. Defenders should block the domain at network perimeter, update URL filtering and endpoint protection lists with the observed indicators, and monitor for attempts to resolve the IP or contact the nameservers. Continuous re‑scanning of the domain with sandbox and AV tools is advised to capture any payloads that may be delivered after initial access.