usdtflasher[.]live[.]thorchainswap[.]com

PhishDestroy identifies usdtflasher.live.thorchainswap.com as an active fake-Tether “USDT flash” scam page designed to trick cryptocurrency users into sending USDT for promised instant returns. The domain resolves to IP 64.20.37.43, was registered on April 12, 2026 through Dynadot Inc, and currently carries a Let’s Encrypt SSL certificate. VirusTotal scanning as of today shows zero detections out of 95 engines, indicating it is not yet widely blocked by antivirus or browser defenses. This domain poses a specific high-risk threat: it masquerades as a legitimate “USDT flasher” or “USDT flash service,” a term used in underground forums to describe fraudulent tools that claim to generate free or instant USDT transfers. The subdomain path “live.thorchainswap.com” is abused to lend false credibility by borrowing the name of a known swap interface. Attackers typically promote such pages via social media ads or private chats, luring victims with messages like “Click to double your USDT instantly.” Once a user connects a wallet or enters private keys or seed phrases, the page either drains funds directly or harvests credentials for later theft. The domain’s recent creation date (April 12, 2026) and low VirusTotal score suggest a fast-moving campaign that has evaded most automated detection layers. Users who visited usdtflasher.live.thorchainswap.com should immediately disconnect any connected wallets, revoke any permissions granted, and move remaining assets to a new wallet with a unique seed phrase. Do not enter private keys, seed phrases, or passwords on this site. Report the domain to your wallet provider, browser, and platforms like PhishDestroy, Google Safe Browsing, and VirusTotal. Consider enabling hardware wallet signing for future transactions to reduce exposure to fake web interfaces. Stay vigilant: any site promising “instant USDT” or “free flash” is almost certainly a scam.