usdtcheck[.]work

This domain, usdtcheck.work, is flagged as a high-risk generic phishing threat. Analysis indicates it is currently active and impersonates a USDT transfer interface, as evidenced by the page title 'TRANSFER USDT'. The domain was registered on April 7, 2026, through GoDaddy.com, LLC, and resolves to IP address 77.245.76.110. Gridinsoft assigns a trust score of 0 out of 100, reflecting strong suspicion of malicious intent. VirusTotal reports 17 out of 95 security vendors flagging this domain, and it appears in 23 AlienVault OTX threat intelligence pulses. The domain is listed on 2 security blocklists and is blocked by PhishDestroy and BLP-Malware. The SSL certificate is issued by Let's Encrypt, which is commonly used by both legitimate and malicious sites. Defenders should block access to usdtcheck.work and the IP 77.245.76.110 at network perimeter, monitor for related subdomains or additional IPs under the same registration, and educate users to avoid entering credentials or financial information on such pages. The exact phishing kit or brand targeted beyond the USDT transfer theme is not yet fully analysed, but the site is confirmed as active and malicious.