usdt[.]skylith[.]cloud

This domain, usdt.skylith.cloud, is identified as a brand impersonation threat targeting users through a fraudulent USDT-based investment scheme. Analysis of the page title, "GroandInvest - USDT Investment Platform," indicates an attempt to deceive victims into believing they are interacting with a legitimate cryptocurrency investment service. The domain mimics established financial platforms to solicit deposits or personal information under false pretenses, a common tactic in cryptocurrency scams where victims are lured with promises of high returns or exclusive investment opportunities. Infrastructure analysis reveals multiple indicators of malicious activity. The domain was registered on February 21, 2026, through HOSTINGER operations, UAB, a registrar frequently associated with high-risk domains. It resolves to the IP address 72.62.241.180 and is flagged by 2 out of 95 security vendors on VirusTotal, with one additional security blocklist listing. The domain employs a Let's Encrypt SSL certificate and utilizes technologies such as Node.js, Ubuntu, Bootstrap, React, Nginx, Next.js, Express, and jsDelivr, which are not inherently malicious but are commonly leveraged in sophisticated phishing campaigns to enhance credibility and evade detection. Users who visited usdt.skylith.cloud or interacted with its content should take immediate remedial actions. If any credentials, financial details, or cryptocurrency transactions were conducted, affected individuals should revoke access to linked accounts, monitor for unauthorized activity, and report the incident to relevant financial institutions or cybersecurity authorities. Additionally, clearing browser caches, running antivirus scans, and verifying the legitimacy of any downloaded files or links associated with the domain are recommended to mitigate potential risks. Given the domain's current offline status, continued vigilance is advised as threat actors may re-establish operations under a different infrastructure.