tetherswap[.]cfd

PhishDestroy identifies active crypto drainer phishing campaign on tetherswap.cfd (Unique Seed: 79699d). This domain is currently active and engineered to deceive users by mimicking legitimate cryptocurrency services, specifically targeting transactions involving Tether (USDT). The site leverages social engineering and fraudulent interfaces to trick users into authorizing malicious transactions that drain wallet funds without consent. Users who interact with this domain risk immediate financial loss due to unauthorized blockchain transactions.

This domain was flagged by 1 of 95 VirusTotal security vendors, indicating low but present detection across global threat intelligence platforms. Registered through WEBCC on November 30, 2025, tetherswap.cfd resolves to IP 188.114.97.3 and holds a valid SSL certificate issued by Google Trust Services. While SSL presence may imply legitimacy, the domain’s recent creation and low detection rate underscore its emergent and deceptive nature. Such combinations are typical of short-lived phishing domains designed to exploit trust before takedown.

As of current monitoring, tetherswap.cfd remains active and poses an elevated risk to cryptocurrency users. Immediate action is recommended: avoid accessing this domain or any links associated with it. Verify URLs through PhishDestroy or trusted threat intelligence feeds before engaging. If exposure occurs, review wallet transaction history immediately and revoke any unauthorized approvals. Block the domain at DNS/network level using 188.114.97.3 and the domain name. Report the incident to relevant wallet platforms and law enforcement if funds are compromised. Monitor for follow-on phishing attempts targeting the same victim profile. Proactive blocking and user awareness are critical to mitigating this active drainer campaign.