tetherfly[.]com

Analysis of www.tetherfly.com was performed on 25 July 2026. The domain is hosted on a Hetzner‑owned server in Finland (IP 65.21.240.167) and resolves to a Windows Server running Microsoft ASP.NET on IIS with Alpine.js present in the page assets. Registration was performed through GoDaddy.com, LLC on 16 March 2026 and the domain uses the default GoDaddy nameservers ns19.domaincontrol.com and ns20.domaincontrol.com. No TLS certificate is configured; the site is reachable only over HTTP, which is consistent with the reported offline status at the time of analysis. The page title returned by the HTTP response is “Tether‑Fly Next‑Gen USDT (BEP20) Crowdfunding Platform”, indicating an attempt to lure victims with a cryptocurrency crowdfunding narrative.

The threat classification in the intelligence set labels the activity as a crypto‑related phishing scam. The domain is currently listed on a single security blocklist and has been blocked by the PhishDestroy service. VirusTotal analysis shows that 2 of 94 scanning engines flagged the domain, confirming at least partial detection of malicious intent. Infrastructure observations confirm that the hosting provider, Hetzner, is a common platform for malicious actors, but no additional IPs or sub‑domains have been identified at this stage. The lack of an SSL certificate reduces the credibility of the site and may be a deliberate choice to avoid certificate‑based reputation checks.

No further public reports or OTX entries were found, leaving the broader campaign scope uncertain. Defenders should add 65.21.240.167 to network‑level deny lists, enforce DNS blocking of www.tetherfly.com, and monitor for any newly registered domains that reuse the same registrar, nameservers, or hosting provider. Continuous re‑scanning of the domain with updated VirusTotal engines is recommended, as additional detections may emerge.