tether[.]ac

This domain, tether.ac, is actively impersonating Tether AC-X wallet services as part of a high-risk phishing campaign targeting cryptocurrency users. Registered on April 26, 2024, through NameCheap, Inc., the domain currently resolves to IP 81.28.12.12 (AS199524, G-Core Labs S.A., US) and returns an HTTP 302 redirect status. The page title explicitly displays 'Tether AC-X,' confirming its intent to mimic Tether-related infrastructure. Infrastructure analysis reveals the use of G-Core Labs nameservers (ns1.gcorelabs.net, ns2.gcdn.services) and a Let's Encrypt SSL certificate (serial E7), which are common in both legitimate and malicious deployments. The domain appears on three security blocklists and is explicitly blocked by MetaMask, ScamSniffer, CryptoFirewall, PhishDestroy, and SEAL, indicating broad recognition as malicious. Gridinsoft assigns a trust score of 0/100, further supporting its classification as a wallet/seed phishing threat. While VirusTotal shows 3 of 95 vendors flagging the domain, this limited detection rate does not diminish the risk given the domain's active status and confirmed impersonation of a cryptocurrency service. Defenders should treat this domain as a confirmed phishing resource. Recommended actions include immediate blocking at the DNS and network levels, monitoring for connections to the resolving IP (81.28.12.12), and alerting users who may have interacted with the domain. The lack of additional details about the phishing kit or specific payloads suggests further investigation is needed to determine the exact attack vectors, but the domain's infrastructure and blocklist status justify proactive containment.