tether[.]info

Analysis of tether.info indicates that the domain was used for a crypto‑related phishing campaign. The site was created on 21 February 2026 and resolves to the IP address 103.228.169.111, which is located in Germany and assigned to ASN 44051 (Fornex Hosting S.L.). Hosting is provided by Fornex, and the domain is registered through REGRU‑RU. The web server runs Nginx and enforces HTTP Strict Transport Security; the TLS certificate is issued by Let’s Encrypt (R12).

An HTTP GET returned status 200, confirming that a page was reachable before the domain was taken offline. The page title captured during the scan reads “Tether USDT – buy stablecoin cryptocurrency and know everything,” matching the declared scam type of a crypto scam. Security‑vendor scanning on VirusTotal flagged the domain in one of ninety‑three engines, and the domain appears on a single external blocklist. PhishDestroy has also marked the domain as blocked.

Additional reputation metrics are poor: Gridinsoft assigns a trust score of 0 out of 100, and the nameserver set consists of ns1.fornex.com, ns2.fornex.com and ns3.fornex.com. The current status is offline, but the historical evidence suggests intentional malicious activity targeting cryptocurrency users. Defenders should add 103.228.169.111 and the associated ASN to network‑level block lists, enforce DNS filtering for tether.info and any future domains using the same registrar or nameserver pattern, and monitor for re‑use of the hosting infrastructure. Continuous observation of threat‑intel feeds for similar crypto‑phishing indicators is recommended to pre‑empt potential re‑emergence.