tethershop-app[.]tusdt[.]org

The domain tethershop-app.tusdt.org was created on 21 February 2026 and is registered through Cloudflare, Inc. DNS resolution points to IP address 172.67.218.185, which is owned by Cloudflare (AS13335) and geolocated to the United States. The site served an SSL certificate issued by Let’s Encrypt (certificate identifier E8) and advertised HTTP Strict Transport Security (HSTS), indicating an attempt to appear legitimate. An HTTP request to the host returned a 403 status code, suggesting that the page is currently inaccessible or deliberately blocked. The page title retrieved from the live endpoint reads “TetherWallet - 키리스 USDT 지갑,” linking the site to a Korean‑language Tether wallet interface and confirming the classification as a crypto‑related scam.

Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low confidence in the site’s legitimacy. VirusTotal analysis recorded a single positive detection out of 93 scanning engines, and the domain appears on one external security blocklist. PhishDestroy has also flagged the host and the domain is presently taken offline. Nameservers roxy.ns.cloudflare.com and vern.ns.cloudflare.com corroborate the Cloudflare hosting environment.

The available evidence points to a generic crypto phishing operation targeting users of USDT wallets, but the specific phishing kit, victim interaction flow, and any credential‑stealing mechanisms remain unobserved. Defenders should continue to block the domain at network perimeter devices, add the IP address 172.67.218.185 to threat‑intel feeds, and monitor for re‑registration or similar sub‑domains that reuse the same infrastructure. Ongoing surveillance of Cloudflare‑hosted assets linked to this domain is advised, as the rapid provisioning capabilities of the provider can facilitate quick re‑deployment of malicious pages.