usdtcrypto[.]space

Analysis of the domain usdtcrypto.space reveals a brand-impersonation campaign targeting Ethereum users, operational since February 21, 2026. The domain was registered through NameCheap, Inc., and resolves to IP address 138.124.125.47, hosted on AS41745 (Baykov Ilya Sergeevich) in the United Kingdom. Infrastructure analysis shows the domain uses NameCheap’s default nameservers (dns1.registrar-servers.com and dns2.registrar-servers.com) and lacks an SSL certificate, increasing exposure to interception risks. The page title, 'USDT Mixer | Tether Mixer - USDT ERC20 and TRC20 Mixing Service,' explicitly positions the site as a cryptocurrency mixing service, a common vector for phishing and fraudulent transactions.

Detection data indicates limited but targeted visibility: the domain appears on one security blocklist (PhishDestroy) and is flagged by one of 95 security vendors on VirusTotal. Gridinsoft assigns a trust score of 0/100, reinforcing its suspicious classification. As of July 22, 2026, the domain has been taken offline, though its prior hosting infrastructure remains documented. The absence of SSL and reliance on a single hosting provider suggest cost-effective, low-effort deployment typical of short-lived phishing operations.

Defenders should treat this domain as a confirmed brand-impersonation threat, particularly for users engaging with Ethereum-based USDT transactions. Monitoring for re-registration or DNS changes is recommended, given the domain’s prior association with fraudulent mixing services. No evidence links this domain to broader phishing kits or multi-brand campaigns, limiting attribution to a standalone operation. The exact content and functionality of the site remain unanalyzed, but the page title and detection patterns align with known cryptocurrency scam tactics.