goldtethers[.]com

This investigation documents the infrastructure and detection profile of goldtethers.com, a domain observed to impersonate the Binance brand in a wallet/seed phishing campaign. The domain was registered through NameSilo, LLC on February 21, 2026 and resolves to the IP address 188.114.97.3, which is assigned to AS13335 Cloudflare, Inc. and geolocated to the United States. No TLS certificate is present; the site operates without HTTPS, which is consistent with the lack of an SSL certificate in the intelligence. The page title returned by the server is “Tether Gold – The World’s Leading Gold Token,” indicating an attempt to leverage the Tether Gold token name while targeting Binance users.

The domain has been blocked by PhishDestroy and appears on a single security blocklist. VirusTotal analysis shows that two of ninety‑five security vendors flagged the domain, reinforcing its malicious classification. Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low reputation. The current operational status is offline, and the threat is rated elevated.

Defenders should add goldtethers.com and its resolving IP 188.114.97.3 to network‑level deny lists, monitor DNS logs for any re‑registration attempts, and enforce strict outbound filtering for connections to Cloudflare‑hosted IP ranges that resolve to newly created domains lacking TLS. Continuous threat‑intel feeds should be consulted for any resurgence of the domain or related Tether‑themed impersonation campaigns targeting Binance users. Incident response teams should also consider updating phishing‑detection signatures to include the observed page title and the specific brand‑impersonation pattern. Regular review of registrar activity, particularly NameSilo, may reveal additional domains created in the same timeframe that could be part of a broader campaign.