usdtvault[.]us

Analysis of usdtvault.us as of July 24 2026 indicates that the domain is associated with an investment‑focused phishing operation. The domain was created on March 6 2026 and registered through Spaceship, Inc., using the authoritative nameservers launch1.spaceship.net and launch2.spaceship.net. A Let's Encrypt R12 certificate secures the site, confirming the presence of HTTPS during its brief online period. DNS resolution points to IP address 172.245.81.106, which belongs to AS36352 HostPapa and is geolocated in the United States. The page title returned from the site, "VaultUSDT - Private.

Secure. Invite-Only," is consistent with the lure of exclusive crypto investment opportunities, a pattern commonly employed by fraudulent actors. The domain appears on three independent security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its malicious reputation. VirusTotal scans show that two of ninety‑four security vendors flagged the domain, providing additional vendor‑level corroboration. Current operational status is offline, and no live HTTP response can be observed, limiting the ability to collect further payload or behavioral indicators.

Uncertainty remains regarding the exact content that was served while the site was active, as no page capture or script analysis is available. Defenders should continue to enforce blocking of the domain at network perimeter and endpoint layers, monitor DNS queries for the associated IP and nameservers, and consider adding the domain to internal threat intel feeds. Users should be warned that any unsolicited invitation to a "private" USDT vault is likely fraudulent, and credential or fund disclosure should be avoided. Ongoing surveillance is advised in case the infrastructure is repurposed for future campaigns.