testturing[.]tur[.]onl

This domain, testturing.tur.onl, is actively flagged as a high-risk crypto scam targeting users through social engineering tactics. Registered on March 7, 2026, via Amazon Registrar, Inc., the domain resolves to IP address 47.128.169.102, hosted on Amazon.com, Inc. infrastructure (AS16509) in Singapore. The site returns an HTTP 200 status, indicating an operational frontend, and employs Vue.js alongside Nginx, with HSTS enforced. SSL certification is provided by Let's Encrypt (R13), a common choice for both legitimate and malicious domains. The page title, 'Turing Protocol,' suggests a thematic focus on cryptocurrency or blockchain, though no specific brand impersonation is confirmed in available data. Infrastructure analysis reveals the use of four AWS nameservers, a pattern consistent with threat actors leveraging cloud providers for resilience and scalability. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and is explicitly flagged by Google Safe Browsing for social engineering. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as malicious. While VirusTotal reports 9 of 94 security vendors detecting the domain, this figure reflects partial coverage and should not be interpreted as exhaustive. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments handling cryptocurrency transactions. The combination of cloud-based hosting, Let's Encrypt SSL, and a recent registration date aligns with common phishing infrastructure patterns. No evidence of takedown or sinkholing is present as of July 12, 2026, and the domain remains accessible. Further analysis of associated wallet addresses or backend endpoints may yield additional indicators for disruption.