quickusdt[.]live

Analysis performed on July 24, 2026 records that the domain quickusdt.live is currently offline. The site was hosted on the IP address 192.250.231.20, which resolves to the United States and is announced by AS14670 WHG Hosting Services Ltd. Technical fingerprinting identified Nginx and OpenResty as the web server stack. The domain’s authoritative name servers are ns31.domaincontrol.com and ns32.domaincontrol.com, both belonging to GoDaddy.com, LLC, which also acted as the registrar for the domain created on February 21, 2026. An SSL certificate issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority – G2 is present, indicating that Transport Layer Security was enabled at the time of capture.

VirusTotal scanned the site and reported a single positive detection out of 93 security vendors, confirming that at least one vendor flagged the domain as malicious. The domain appears on one public blocklist and has been actively blocked by the PhishDestroy service, reinforcing the expectation that it was used for phishing‑related activity. The page title returned by the HTTP response was “QuickUsdt ||Decentralized Stablecoin,” which suggests an attempt to lure victims with cryptocurrency terminology. Given the combination of a recent registration, a dedicated SSL certificate, a single vendor detection, and inclusion on a phishing‑focused blocklist, the infrastructure appears to have been deployed for a short‑lived malicious campaign that has since been taken down.

Defenders should continue to block the domain at perimeter devices, monitor the associated IP address for any resurgence, and consider adding the domain to internal threat‑intel feeds. Additional analysis of any residual DNS or TLS artifacts may reveal further command‑and‑control links or victim attribution. Until the domain is fully retired, organizations are advised to treat any inbound traffic to quickusdt.live as hostile.