sending-erc20-usdt[.]com

PhishDestroy identifies sending-erc20-usdt.com as an active generic phishing domain impersonating legitimate USDT (Tether) transaction services. The domain employs a deceptive naming convention to lure cryptocurrency users into authorizing fraudulent ERC20-USDT transfers, with threat actors leveraging social engineering tactics to trick victims into connecting malicious wallet drainers. While the exact drainer kit remains under forensic analysis, the domain’s structure and SSL certificate (Let’s Encrypt) suggest a hastily deployed operation designed to exploit trust in established blockchain protocols. This domain was flagged on May 07, 2026, and is registered through Ultahost, Inc. It resolves to IP address 159.100.6.19 and currently shows 1/95 detections on VirusTotal, indicating it has evaded automated detection systems. The domain has not been flagged in Google Safe Browsing (GSB) and remains absent from major blocklists, amplifying its potential reach. With a recent creation date and no historical reputation, the threat poses a high-risk window for unprotected users, especially those engaging in ERC20 token transfers. As of this report, sending-erc20-usdt.com remains active and under investigation, with no active takedown initiated by hosting or registrar providers. Users are strongly advised to block the domain at the network level, avoid wallet connections, and report any interaction to their security teams. Given the absence of detections and blocklist coverage, the risk of exposure remains elevated. Immediate defensive actions include updating DNS blocklists, inspecting outbound traffic for connections to 159.100.6.19, and educating users on verifying transaction endpoints before authorizing transfers.