usdteam[.]pro

The domain usdteam.pro was registered on February 21, 2026 through the REGRU-RU registrar and resolves to the IPv4 address 37.140.192.178, which is mapped to Russia (AS197695, operated by REG.RU). The authoritative nameservers listed are ns1.hosting.reg.ru and ns2.hosting.reg.ru. No TLS certificate is presented for the host, indicating that communications are unencrypted. The site’s HTML title is "USDTeam - Обучение арбитражу криптовалют", and the campaign is classified as brand impersonation targeting the Telegram brand.

The domain appears on a single security blocklist and has been flagged by one of ninety‑five security vendors on VirusTotal. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high likelihood of malicious intent. PhishDestroy has also blocked the domain, and the current operational status is recorded as offline. Observable evidence confirms the use of a Russian‑based registrar and hosting infrastructure, a lack of SSL protection, and minimal detection coverage beyond a single vendor flag.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms employed, as the page content beyond the title has not been publicly analyzed. Defenders should continue to block the domain and its associated IP address, monitor for additional domains registered with the same registrar or nameservers, and consider adding the domain to internal deny lists. Ongoing vigilance is recommended to detect potential re‑hosting or replication of the impersonation technique targeting Telegram users.