usdtera[.]top

Analysis of usdtera.top indicates that the domain is currently offline but was previously identified as a Google brand impersonation campaign. The site was registered on December 20, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolved to the IPv4 address 212.32.225.148, which is hosted by LeaseWeb Netherlands B.V. (AS60781) in the Netherlands. No SSL certificate was observed, meaning the site operated without HTTPS encryption. The page title retrieved from the live host, "USDTERA - Платим 50% ежедневно," suggests a Russian‑language offering of daily payments, but no further content analysis is available.

The domain was flagged by PhishDestroy and appears on a single security blocklist, indicating at least one external sinkhole or reputation service has listed it. Gridinsoft assigned a trust score of 0 out of 100, reflecting a complete lack of trustworthiness. VirusTotal scanned the domain and recorded four positive detections out of ninety‑three submitted security vendors, confirming that multiple anti‑malware engines flagged the host.

Nameservers are delegated to ns1.steadyhost.ru, ns2.steadyhost.ru, ns8.steadyhoster.com, and ns9.steadyhoster.com, which are commonly associated with malicious hosting infrastructure. Uncertainty remains regarding the exact phishing kit or payload delivered, as no forensic capture of the landing page is provided. Defenders should continue to block the domain at network perimeter controls, update URL filtering policies to include the observed IP and nameserver ranges, monitor for any resurgence of the domain or its resolver records, and consider sharing the indicator set with threat‑intel sharing platforms to aid broader detection efforts.