tetherasset[.]com

Analysis of www.tetherasset.com indicates an active crypto‑drainer phishing operation. The domain was registered on May 05, 2026 through IONOS SE and resolves to IP 185.158.133.1, located in Dortmund, Germany. An HTTP 302 response is observed, suggesting the site redirects visitors to a secondary payload or credential‑harvesting endpoint. The page title "TetherAsset — USDT 人 The People's TRC20 Settlement Asset" aligns with the reported scam type, confirming the intent to target users of the TRC20 USDT token. The SSL certificate is issued by Google Trust Services under the WE1 profile, and HSTS is enforced, while traffic is proxied through Cloudflare, providing basic transport security but also obscuring the origin server. Reputation data shows a Gridinsoft trust score of 0/100 and 4 of 91 VirusTotal scanners flag the domain as malicious. The nameservers (ns1024.ui-dns.biz, ns1032.ui-dns.com, ns1107.ui-dns.org, ns1114.ui-dns.de) are typical of fast‑changing hosting services. The domain appears on a single security blocklist and has been blocked by PhishDestroy, yet it remains reachable. Uncertainty remains regarding the exact content served after the redirect and any additional command‑and‑control infrastructure. Defenders should block the domain and its resolving IP at perimeter devices, monitor DNS queries for the listed nameservers, and consider sinkholing the IP range. Continuous re‑evaluation is advised as the threat actor may shift hosting or employ additional redirects.