usdtflow[.]life

Analysis of usdtflow.life indicates an active crypto drainer operation. The site presents the page title "USDT Transfer" and was registered on May 07, 2026 through GoDaddy.com, LLC. It serves content over HTTPS using a Let’s Encrypt certificate (E8) and enforces HSTS. Infrastructure inspection shows the domain resolves to IP 63.176.8.218, an AWS EC2 instance in the eu-central-1 region (Germany). The domain appears on a single security blocklist and is listed by PhishDestroy. VirusTotal records three detections out of ninety-two scanners, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. Detected technologies include Netlify and jsDelivr, suggesting a static hosting approach. HTTP responses return status 200, indicating the site is reachable. While the exact payload and user‑interaction flow have not been publicly disclosed, the combination of a USDT‑related title, crypto‑drainer classification, and low trust scores align with known cryptocurrency fraud patterns. Defenders should block the domain at network perimeters, add it to URL filtering and threat‑intel feeds, and monitor for any related command‑and‑control activity originating from the identified AWS endpoint. Continuous re‑evaluation is advised in case additional indicators emerge.