www-tensor[.]trade

Analysis of www-tensor.trade, registered through NameCheap, Inc. on 03 September 2025, shows a clear attempt to impersonate the Tensor brand, a Solana NFT marketplace. The site’s HTML title mirrors the legitimate brand by using “Tensor | Solana’s Leading NFT Marketplace.” The domain resolves to IP 69.57.162.209, which is owned by AS22612 Namecheap, Inc. and geolocated to the United States. No TLS certificate is presented, indicating the site is served over plain HTTP, which is typical for low‑effort phishing infrastructure. The domain is listed on two public blocklists and has been actively flagged by PhishDestroy and ScamSniffer, confirming its classification as a wallet/seed phishing operation.

VirusTotal scans have returned three positive detections out of ninety‑five AV engines, providing additional independent confirmation of malicious behavior. Nameservers dns1.namecheaphosting.com and dns2.namecheaphosting.com further tie the hosting to the registrar’s default infrastructure. At the time of assessment the site is taken offline, but the infrastructure remains observable. The lack of an SSL certificate, the recent registration date, and the use of a generic hosting provider suggest a throwaway deployment designed to harvest cryptocurrency wallet seeds.

No additional evidence such as phishing page screenshots or payload hashes is currently available, leaving the exact content of the landing page unverified. Defenders should continue to block the domain at DNS and network layers, monitor for any re‑use of the IP address or associated name‑server patterns, and add the domain to internal blocklists. Continuous re‑scanning with multi‑engine services is advisable to capture any future changes in detection status. Organizations using the Tensor brand should educate users about the absence of TLS and encourage verification of URLs before entering wallet credentials.