tetheraml-bot[.]com

The domain tetheraml-bot.com is identified as a brand_impersonation threat targeting Polygon, a blockchain platform. Analysis indicates the domain was designed to mimic legitimate Polygon services, specifically presenting an "AML Check" interface to deceive users. As of the latest assessment, the domain has been taken offline, though prior activity suggests malicious intent. Infrastructure analysis reveals the domain was registered on October 16, 2025, through Internet Domain Service BS Corp. It resolved to the IP address 82.221.129.39, a host previously associated with suspicious activity. Security telemetry shows the domain was flagged by 3 of 95 vendors on VirusTotal, indicating low but notable detection coverage. Additionally, it appeared on one security blocklist, further corroborating its classification as a potential threat. The page title "AML Check" aligns with common phishing tactics aimed at cryptocurrency users seeking compliance verification. The domain is currently offline, reducing immediate risk to users. However, organizations and individuals should remain vigilant for similar impersonation attempts. It is recommended to monitor for newly registered domains under the same registrar or resolving to the identified IP address. Users should verify the authenticity of any AML or compliance-related services by accessing official Polygon channels directly. Security teams are advised to update blocklists with the domain and associated indicators to prevent future exposure.