sending-usd-tether-000001[.]netlify[.]app

Analysis of the domain sending-usd-tether-000001.netlify.app shows that it is currently offline, returning HTTP 404 for all requests. The site was hosted on Netlify and served an HSTS header, indicating the use of HTTPS with a DigiCert Global G2 TLS RSA SHA‑256 certificate issued in 2020. DNS resolution points to the IP address 35.157.26.135, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in Germany. The domain was registered through Netlify’s own registration service, and no authoritative name servers were reported (NS_NOT_FOUND).

The page title returned by the server is “Transfer Trust Wallet”, and the domain is explicitly listed as impersonating the TrustWallet brand. Threat intelligence platforms PhishDestroy and ScamSniffer have both flagged the domain, and it appears on two public blocklists. The classification recorded by the intelligence feed is a crypto‑scam, specifically a brand‑impersonation attempt targeting TrustWallet users. VirusTotal analysis shows that one out of ninety‑five security vendors raised a detection, reinforcing the malicious assessment.

Because the site is no longer reachable, visual or functional characteristics cannot be verified, and the exact phishing kit or payload remains unknown. Defenders should continue to block the domain and the associated IP address, add the host to internal URL filtering rules, and monitor for any future re‑registration of the same or similar Netlify‑hosted subdomains. Ongoing observation of the Netlify infrastructure and the Amazon hosting range is advised, as attackers frequently recycle IP blocks for new impersonation campaigns. The evidence collected—HTTP status, SSL certificate, hosting provider, IP ownership, blocklist entries, and brand‑impersonation label—provides sufficient justification for elevated risk treatment.