tetherbozum[.]com

This domain, tetherbozum.com, is identified as a phishing site impersonating the Tether (USDT) cryptocurrency wallet platform. Analysis indicates the site employs a crypto drainer mechanism, designed to siphon digital assets from victims under the guise of legitimate Tether services. The page title, 'Tether Bozum – Bozum Tether - Tether Bozum,' reinforces the impersonation by repeatedly referencing the Tether brand, while the underlying infrastructure leverages WordPress and PHP, common components in phishing kits targeting cryptocurrency users. Technical indicators reveal the domain was registered on April 18, 2024, through NameCheap, Inc., a registrar frequently associated with malicious domains. It resolves to the IP address 188.114.97.3, which is part of a network range previously observed in similar phishing campaigns. Detection metrics show 4 out of 95 security vendors flagged the domain as malicious on VirusTotal, while it appears on at least one security blocklist. The domain’s SSL certificate is issued by Google Trust Services, providing a veneer of legitimacy despite its fraudulent purpose. Gridinsoft’s trust score for the domain is 0/100, further corroborating its malicious classification. As of the latest assessment, tetherbozum.com has been taken offline, likely in response to blocklist inclusion and security vendor detections. However, the infrastructure remains a residual risk, as threat actors may re-deploy the domain or migrate to newly registered lookalike domains. Users are advised to verify wallet addresses through official channels and employ browser-based security extensions to block known phishing domains. Cryptocurrency holders should treat unsolicited wallet prompts or login requests as high-risk interactions, particularly those referencing Tether or similar high-value digital assets.