tether[.]icu

Analysis of tether.icu shows a newly registered domain (creation date 21 February 2026) actively hosting a crypto‑related scam. The domain resolves to IP 162.213.255.29, hosted in the United States under AS22612 (Namecheap, Inc.) and uses the public DNS servers dns1.namecheaphosting.com and dns2.namecheaphosting.com. The site returns HTTP 200 and presents a valid Sectigo Limited DV certificate, which may be used to lend legitimacy to malicious content. Reputation data is poor: Gridinsoft assigns a trust score of 0/100, and 14 of 93 VirusTotal scanners have flagged the domain as malicious. The domain appears on two external blocklists and has been cited in one AlienVault OTX pulse, confirming community awareness of its malicious intent. It is already blocked by PhishDestroy and Enkrypt, indicating that security vendors have incorporated it into their defensive feeds. While the exact page content has not been examined, the listed scam type is a crypto scam, suggesting attempts to lure victims into transferring cryptocurrency or disclosing private keys. Defenders should add tether.icu and its resolving IP 162.213.255.29 to network deny lists, ensure URL filtering solutions block the domain, and monitor for any related traffic patterns. Continuous threat intel feeds should be consulted for any emerging indicators tied to this infrastructure, and endpoint protection policies should be updated to flag the domain as high‑risk.