# PhishDestroy domain threat record: tetherusdtistanbul.com.websitedukkani.com.tr

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/tetherusdtistanbul.com.websitedukkani.com.tr/
Machine-readable companion: https://phishdestroy.io/domain/tetherusdtistanbul.com.websitedukkani.com.tr/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-08-09 22:40:09 UTC
- Last availability or vendor check: 2026-10-27 23:27:44 UTC
- Stored record updated: 2026-10-27 23:27:44 UTC
- VirusTotal detections in the stored snapshot: 17/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Tether

## Stored infrastructure

- Observed IP address: 78.135.82.192
- Last stored HTTP status: 403
- Registration date in stored WHOIS data: 2026-06-10 22:00:00 UTC

## Evidence links

- VirusTotal domain view: https://www.virustotal.com/gui/domain/tetherusdtistanbul.com.websitedukkani.com.tr
- Certificate Transparency search: https://crt.sh/?q=%25.tetherusdtistanbul.com.websitedukkani.com.tr
- Web Archive lookup: https://web.archive.org/web/*/https://tetherusdtistanbul.com.websitedukkani.com.tr/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
tetherusdtistanbul.com.websitedukkani.com.tr is a hostname on the PhishDestroy blocklist whose name combines Tether's USDT stablecoin with the city of Istanbul. It sits as a subdomain under websitedukkani.com.tr rather than on a domain of its own. PhishDestroy first saw it on 2026-08-10. As of 2026-10-19 the server was still responding, but its page content could not be retrieved.

How the scam works
The page currently returns a "403 Forbidden" title, so no scam content is visible right now, and that title differs from the risk we flagged. The hostname itself is the clearest signal. It is built to look like a local USDT service in Istanbul, which is the kind of branding used to attract people who want to buy, sell or cash out Tether. Sites themed this way typically put users at risk of sending stablecoins or cash to an operator who never delivers, or of handing over account details. The exact scheme behind this host has not been confirmed.

Evidence
On 2026-09-20, 17 of 89 VirusTotal engines flagged the hostname. The vendors include alphaMountain.ai, BitDefender, Chong Lua Dao, CRDF, CyRadar, Forcepoint ThreatSeeker, Fortinet and G-Data. Several of these are independent threat feeds and reputation services, so the flags do not trace back to a single source. PhishDestroy also lists the host on its own blocklist.

Infrastructure
The site resolves to 78.135.82.192 on the HostLAB Bilisim Teknolojileri A.S. network in Turkey. That matches the Istanbul theme in the name and suggests a Turkish-language audience. Because it lives as a subdomain of websitedukkani.com.tr, whoever runs it did not need to register a domain of their own. That makes it cheap to set up and easy to replace if it gets taken down.

What to do
Do not send USDT or cash to anyone you reached through this site, and do not pay any further "fees" or "release charges" to recover money you already sent. If you entered a password, phone number or exchange login, change it right away and turn on app-based two-factor authentication. Keep any transaction hashes and chat logs, and report them to your exchange and to local police. Defenders should block the hostname and the IP 78.135.82.192. It is also worth watching for other Tether-themed subdomains appearing under the same parent domain.

Useful links
VirusTotal report: https://www.virustotal.com/gui/domain/tetherusdtistanbul.com.websitedukkani.com.tr
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=tetherusdtistanbul.com.websitedukkani.com.tr
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:50:05 UTC

## Stored page captures

- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/65e621ce-522c-4fdc-a1e5-f7290983c93b.png
  Captured: 2026-08-11 01:07:17 UTC
  Source report: https://radar.cloudflare.com/scan/65e621ce-522c-4fdc-a1e5-f7290983c93b
  SHA-256: 28fa085914a8eac5b91d635b1475d50ebd3886d62a2cad2787a06d991cd27055

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T10:25:25Z",
        "uuid": "65e621ce-522c-4fdc-a1e5-f7290983c93b",
        "scanned_at": "2026-08-11T01:07:17Z",
        "final_url": "https://tetherusdtistanbul.com.websitedukkani.com.tr/",
        "status": 403,
        "history": [
            {
                "url": "https://tetherusdtistanbul.com.websitedukkani.com.tr/",
                "status": 403
            }
        ],
        "dom_hash": "0a226e7ff0226df9c1b312239c3a21c005ded97c86cc005e8bbdb5decc778a66",
        "doc_hash": "7271dd5c11fb9a1052a5e91a09afbe7d148fd3388dc51c338df62a0a16f06739",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "tetherusdtistanbul.com.websitedukkani.com.tr",
                "type": "A",
                "value": "78.135.82.192"
            }
        ],
        "dnssec_valid": false,
        "ip": "78.135.82.192",
        "whois": {
            "created": "2026-06-11T00:00:00Z",
            "expires": "2027-06-10T00:00:00Z"
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T03:31:18Z",
        "analysis_at": "2026-10-09T03:23:27Z",
        "stats": {
            "timeout": 0,
            "harmless": 43,
            "malicious": 15,
            "suspicious": 1,
            "undetected": 33
        },
        "detections": {
            "CRDF": "malicious",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "LevelBlue": "phishing",
            "PhishFort": "phishing",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "first_seen": "2026-07-08T15:09:33Z",
        "dns": [
            {
                "ttl": 14400,
                "type": "TXT",
                "value": "v=spf1 +a +mx +ip4:78.135.82.192 ~all"
            },
            {
                "ttl": 14400,
                "type": "A",
                "value": "78.135.82.192"
            }
        ],
        "dns_at": "2026-10-09T03:24:08Z",
        "jarm": "29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae",
        "cert": {
            "san": [
                "*.com.websitedukkani.com.tr",
                "www.teknokervani.com.websitedukkani.com.tr",
                "www.tetherusdtistanbul.com.websitedukkani.com.tr"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "6ec3020499abac4ee0b2a91f619259d3bea",
            "sha256": "56661b96cf4fa078485a749a466de268d68ae7973f8968327a1245834abe4ee5",
            "subject": "www.teknokervani.com.websitedukkani.com.tr",
            "valid_to": "2026-12-08T18:35:18Z",
            "valid_from": "2026-09-09T18:35:19Z"
        },
        "whois": {
            "status": [
                "Active"
            ]
        }
    }
}
```