houldes[.]xyz

The domain houldes.xyz was observed hosting a counterfeit Tether airdrop page, as indicated by the page title “TETHER AIRDROP” and the classification of the underlying phishing kit as an “Airdrop Scam”. The site was registered through PDR Ltd. d/b/a PublicDomainRegistry.com and the domain creation timestamp is 21 February 2026. Authoritative DNS records show the domain is delegated to the Cloudflare nameservers sam.ns.cloudflare.com and walk.ns.cloudflare.com, and the authoritative IP resolves to 188.114.96.3, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States. No TLS certificate was presented during connection attempts, confirming the absence of HTTPS protection.

VirusTotal scanned the domain and four of ninety‑five security vendors flagged it as malicious, reinforcing the suspicion of phishing activity. The domain appears on a single public security blocklist and is also listed by the PhishDestroy blocklist, indicating that at least one external mitigation service has taken action. The current operational status is offline, and the site has been taken down, but the infrastructure details remain useful for attribution and for detecting potential re‑hosting. The risk rating assigned is elevated, reflecting the combination of a targeted crypto‑scam theme, confirmed malicious vendor detections, and the use of reputable cloud hosting that can mask the true origin.

Defenders should ensure that the domain is added to network‑level deny lists, enforce DNS‑level blocking for both the A and AAAA records, and monitor for any resurrection of the domain or the associated IP address. Additional mitigation steps include inspecting outbound traffic for connections to Cloudflare‑hosted IP ranges that have recently served malicious content, and employing certificate‑pinning or strict TLS policies to prevent accidental connections to non‑TLS sites.