tenxo[.]io

On July 23, 2026, the domain tenxo.io was observed operating as a high‑risk brand‑impersonation site that claims to represent the “across” brand. The domain was registered on August 12, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently hosted on an IP address (162.215.230.9) owned by AS46606 Unified Layer in the United States. DNS records show three authoritative nameservers: ns.tenxo.io, ns1.ddbh-plesk-web1.webhostbox.net, and ns2.ddbh-plesk-web1.webhostbox.ne, indicating a mixed hosting configuration. The web server returns an HTTP 301 redirect and serves a TLS certificate issued by Let’s Encrypt (R13), which is valid but does not provide any assurance of legitimacy.

The page title returned by the server is “Tenxo”, and the site has been classified as a crypto‑scam in the intelligence feed. Detection metrics show that the domain appears on one security blocklist and has been blocked by PhishDestroy. VirusTotal reports that 14 of 95 scanning engines flagged the domain, and AlienVault OTX lists the domain in 15 threat‑intelligence pulses. A Gridinsoft trust score of 0 out of 100 further underscores the malicious reputation.

The evidence confirms active malicious infrastructure, yet no public content analysis is available to detail the exact phishing vector or payload. Defenders should continue to block tenxo.io at network perimeter and DNS layers, monitor for connections to 162.215.230.9, and update intrusion‑detection signatures to reflect the observed TLS fingerprint and HTTP 301 behavior. Ongoing observation is recommended to capture any changes in hosting or payload delivery that could affect remediation actions.