tetherfasset[.]cx

Analysis of the domain tetherfasset.cx, registered on July 6, 2026, through CentralNic Ltd, indicates it is currently active and under investigation for generic phishing activity. The domain resolves to the IP address 188.114.96.3, which is associated with Cloudflare infrastructure, as further evidenced by the detection of Cloudflare and Cloudflare Browser Insights technologies. The SSL certificate is issued by Google Trust Services, a common feature in both legitimate and malicious domains leveraging Cloudflare's services. The page title 'Welcome!' provides limited insight into the specific content or target of the phishing campaign. As of July 13, 2026, no detections have been recorded by the 95 vendors that scanned the domain, though the absence of detections does not confirm the domain's safety or legitimacy. The domain has been referenced in two threat intelligence pulses on AlienVault OTX, suggesting prior identification by security researchers or automated systems. Infrastructure analysis reveals the use of HTTP/3, a protocol increasingly adopted for both legitimate and malicious traffic due to its performance benefits. The reliance on Cloudflare may serve to obfuscate the true origin of the phishing infrastructure, complicating attribution and takedown efforts. Defenders should monitor network traffic for connections to 188.114.96.3 and the domain tetherfasset.cx, particularly in environments where cryptocurrency or financial assets are managed. Given the domain's recent registration and active status, further investigation is warranted to determine the exact nature of the phishing content and potential targets. Organizations are advised to block or flag the domain pending additional analysis.