prmsyn-basvrs-yap[.]cfd

The domain prmsyn-basvrs-yap.cfd has been identified as a confirmed phishing site impersonating a Tether Plesk control panel interface. Analysis indicates this is a brand impersonation threat designed to harvest credentials or deploy cryptocurrency wallet drainers under the guise of legitimate Tether administrative tools. The domain is currently offline, though prior activity suggests it may have been operational for credential harvesting or malicious script injection. Infrastructure analysis reveals the domain was registered on February 21, 2026, an anomalous creation date likely intended to evade automated detection systems that prioritize recently registered domains. It resolved to IP address 167.99.38.75, hosted on AS14061 (DigitalOcean, LLC) in the Netherlands. The domain appears on one security blocklist and has been flagged by 17 of 95 vendors on VirusTotal, with detection labels including phishing, credential theft, and cryptocurrency-related fraud. The SSL certificate is issued under the R13 root, a non-standard certificate authority that may indicate attempts to bypass reputation-based filtering. The page title, 'Tether Plesk,' directly references the targeted brand and administrative software, reinforcing the impersonation vector. Current status indicates the domain has been taken offline, though associated infrastructure remains a potential risk. Organizations should treat this domain as compromised and implement the following measures: block DNS resolution and IP-level access to 167.99.38.75, monitor for references to 'Tether Plesk' in web traffic logs, and alert users to the impersonation of Tether administrative interfaces. Security teams should review historical logs for connections to the domain or IP, particularly from systems with cryptocurrency wallet software or administrative access. The anomalous registration date and use of non-standard SSL certificates suggest the threat actor may attempt to reuse this infrastructure; proactive monitoring of DigitalOcean IP ranges associated with this ASN is recommended for related activity.