tetheraudit-bot[.]com

Analysis of tetheraudit-bot.com shows a typical brand impersonation infrastructure targeting Polygon users. The domain was registered on May 31, 2025 through Internet Domain Service BS Corp. and resolves to IP address 82.221.136.24, which belongs to AS50613 Advania Island ehf in Iceland. The authoritative nameservers are buffy.ns.orangewebsite.com and siti.ns.orangewebsite.com, both hosted by the same provider. No TLS certificate is presented, indicating the site was served over plain HTTP only.

The page title returned by the server is "AML Check," a generic term that does not reveal a legitimate service but aligns with the wallet/seed phishing kit described in the intelligence. VirusTotal scans flagged the domain on 17 of 95 security engines, providing independent confirmation of malicious intent. The domain is listed on a security blocklist and has been actively blocked by the PhishDestroy sinkhole, confirming that remediation actions have already been applied. Current status is offline, suggesting the operators have taken the site down, possibly due to takedown efforts or a shift to a new infrastructure.

Defenders should continue to monitor the IP 82.221.136.24 for any re‑use, enforce DNS‑based blocking of the domain and its nameservers, and add the domain to internal threat feeds. Network sensors should alert on any HTTP requests to the domain or its IP, especially from endpoints handling Polygon wallet credentials. Because the site lacked SSL, any intercepted traffic would be in clear text, increasing the risk of credential leakage. Continuous verification of blocklist updates and periodic re‑scans on VirusTotal are recommended to capture any re‑registration attempts that may reuse the same branding or infrastructure.