# PhishDestroy domain threat record: tetherescan.onrender.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/tetherescan.onrender.com/ Machine-readable companion: https://phishdestroy.io/domain/tetherescan.onrender.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-08-31 11:12:21 UTC - Last availability or vendor check: 2026-10-22 10:10:48 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 9/89 - Independent public blocklist matches in the stored snapshot: 1 - Matching public blocklists: ScamSniffer - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: ethereum ## Stored infrastructure - Observed IP address: 216.24.57.7 - Registrar in stored WHOIS data: Render Services Inc. - Last stored HTTP status: 301 - Registration date (registry RDAP, onrender.com): 2015-03-28 01:20:58 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a05783-d8ec-74cf-b17a-dcc0bdd72bb1/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/tetherescan.onrender.com - Certificate Transparency search: https://crt.sh/?q=%25.tetherescan.onrender.com - Web Archive lookup: https://web.archive.org/web/*/https://tetherescan.onrender.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview tetherescan.onrender.com is an impersonation phishing page that presents itself as "Tether Web3 | USDT Verifier (ERC‑20)". It targets people holding USDT on Ethereum. The hostname blends Tether with Etherscan, the familiar Ethereum block explorer, to look like an official checking tool. PhishDestroy first flagged it on 2026-08-31, and as of 2026-10-19 the site was still alive and serving a redirect. How the scam works Fake "USDT verifier" pages offer to confirm that your tokens are genuine, unfrozen or eligible for something, but only after you connect a wallet. The verification step is usually a disguised transaction or signature, often a token approval that lets a third party move your USDT. Once that permission is granted, the balance can be transferred out without further prompts, and on-chain transfers cannot be reversed. Neither Tether nor any block explorer requires you to connect a wallet to verify tokens. Evidence On 2026-09-14, 9 of 89 VirusTotal engines flagged the page, including alphaMountain.ai, BitDefender, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, PhishFort and URLQuery. That number is modest, so many security tools will not block it. However, PhishFort and URLQuery focus on phishing, and that adds weight to the verdict. The site is also listed on ScamSniffer, a Web3-focused blocklist, alongside PhishDestroy. Infrastructure The page runs as a subdomain on Render's free-tier app platform. It is hosted on Render's network in the US, with Render Services Inc. as registrar of the parent domain. The 2015-03-28 registration date belongs to onrender.com itself, not to this operator, so the long domain age says nothing about trustworthiness. Deploying on a shared platform lets a scammer launch quickly under a reputable parent domain. The Google Trust Services certificate shows only that the connection is encrypted, not that the site is legitimate. What to do If you connected a wallet or approved anything on this page, open a token-approval checker and revoke any USDT allowances you do not recognize. Then move your remaining funds to a fresh wallet. If you entered a seed phrase, treat that wallet as compromised and transfer assets immediately. Defenders should block the full hostname, not all of onrender.com. Report the subdomain to Render so the app can be removed, and add it to wallet and browser blocklists while it remains reachable. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a05783-d8ec-74cf-b17a-dcc0bdd72bb1/ VirusTotal report: https://www.virustotal.com/gui/domain/tetherescan.onrender.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=tetherescan.onrender.com Archived copy: https://web.archive.org/web/20260831112101/https://tetherescan.onrender.com/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:53:15 UTC ## Stored page captures - Primary capture: https://i.ibb.co/v6FY687y/dc10f53a20a3.png Captured: 2026-08-31 11:12:21 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a05783-d8ec-74cf-b17a-dcc0bdd72bb1.png Captured: 2026-08-31 11:12:21 UTC Source report: https://urlscan.io/result/01a05783-d8ec-74cf-b17a-dcc0bdd72bb1/ ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T04:25:33Z", "uuid": "01a05783-d8ec-74cf-b17a-dcc0bdd72bb1", "scanned_at": "2026-08-31T11:11:00Z", "final_url": "https://tetherescan.onrender.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://tetherescan.onrender.com/", "from": "http://tetherescan.onrender.com/", "status": 307 } ], "ip": "216.24.57.15", "ptr": "ip-216-24-57-15.ingress.render.com", "domains": [ "cdn.jsdelivr.net" ], "ips": [ "104.17.207.5", "216.24.57.15" ], "asns": [ "13335", "397273" ], "countries": [ "US" ], "doc_hash": "0fdc307deda8fea14f56553c410e810eb22b0bb2d34598964d4f9216dd9a0416", "script_hashes": [ "555b2d047e9329a7fa4204c8a5806b3f3288250109769472ed1a251df5bac1ac", "a473343e715a152b2073ea23cbc4501b5f459f4c9edf5a532f52afdaf42c2c67" ], "globals": [ "_ethers", "ethers", "CONFIG" ], "tls": { "san": [ "onrender.com", "*.onrender.com" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "onrender.com", "protocol": "TLS 1.3", "valid_to": "2026-10-22T21:54:17Z", "valid_from": "2026-07-24T20:54:20Z" }, "domain_age_days": 0, "apex_age_days": 0, "tls_age_days": 37, "tls_valid_days": 90, "requests": 6, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 100, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=315360000; includeSubdomains; preload", "x-content-type-options": "nosniff" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:36:47Z", "uuid": "cc5bf8ae-b3f5-4459-9cb2-c685dedf9a94", "scanned_at": "2026-08-31T11:51:04Z", "final_url": "https://tetherescan.onrender.com/", "status": 200, "history": [ { "url": "https://tetherescan.onrender.com/", "status": 200 } ], "dom_hash": "5c70b687092d30f6b24868789fe25b7fa6f091c13fb35e253e371bdf26204791", "doc_hash": "0fdc307deda8fea14f56553c410e810eb22b0bb2d34598964d4f9216dd9a0416", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "tetherescan.onrender.com", "type": "CNAME", "value": "gcp-us-west1-1.origin.onrender.com" }, { "name": "gcp-us-west1-1.origin.onrender.com", "type": "CNAME", "value": "gcp-us-west1-1.origin.onrender.com.cdn.cloudflare.net" }, { "name": "tetherescan.onrender.com", "type": "CNAME", "value": "gcp-us-west1-1.origin.onrender.com" }, { "name": "gcp-us-west1-1.origin.onrender.com", "type": "CNAME", "value": "gcp-us-west1-1.origin.onrender.com.cdn.cloudflare.net" } ], "dnssec_valid": false, "ip": "216.24.57.7", "whois": { "registrar": "Amazon Registrar, Inc.", "created": "2015-03-28T01:20:58Z", "updated": "2026-05-15T17:25:02Z", "expires": "2027-03-28T01:20:58Z", "nameservers": [ "ns-1324.awsdns-37.org", "ns-1829.awsdns-36.co.uk", "ns-245.awsdns-30.com", "ns-813.awsdns-37.net" ] } } } ```