exotic[.]teslacarss[.]com

Analysis of exotic.teslacarss.com shows a high‑confidence phishing indication targeting the Tesla brand. The site’s sole visible attribute is the HTML page title “Tesla,” which aligns with the reported generic phishing classification. Domain registration data reveal creation on September 18, 2025 through Global Domain Group LLC, a registrar commonly observed in malicious infrastructure. The name servers ns1.coreserverhost.com and ns2.coreserverhost.com resolve the domain to IP address 198.12.80.250, an address hosted in the United States under ASN 36352, which belongs to HostPapa. No TLS certificate is present, meaning the site operates without encryption and would be served over plain HTTP.

A Gridinsoft trust score of 0 out of 100 further confirms the lack of legitimacy. VirusTotal has recorded 13 of 95 security‑vendor detections flagging the domain as malicious, indicating consensus among multiple scanners. The domain appears on one known security blocklist and is explicitly blocked by the PhishDestroy service, reinforcing its status as an active threat vector. Current monitoring reports the site as offline, but the underlying infrastructure remains reachable, and the IP address may be reused for related campaigns.

Defenders should add exotic.teslacarss.com and its resolving IP 198.12.80.250 to block lists, enforce DNS‑based denial of resolution, and monitor outbound traffic for connections to the same host. Given the lack of TLS, any attempted credential submission would be transmitted in clear text, raising the risk of credential harvesting. Continuous watch of the associated name servers and registrar may reveal future domains using the same registration patterns. Until the domain is fully taken down, precautionary network‑level controls are recommended to mitigate exposure to this confirmed Tesla phishing site.