tesla[.]xn--mchten-wxa[.]vip

PhishDestroy has identified tesla.club.mchten-wxa as a fraudulent Tesla impersonation site designed to harvest user login credentials through a fake authentication portal. This domain employs a lookalike URL structure (xn--mchten-wxa.vip) that visually mimics Tesla’s official online services to deceive visitors into entering sensitive account information. The page likely mimics Tesla’s login workflow, including email and password fields, to capture credentials that attackers can use for unauthorized account access or identity theft. Security analysis confirms this domain is part of a growing trend of brand impersonation phishing campaigns targeting high-profile automotive brands to exploit user trust and gain control over valuable digital assets. This domain was flagged through a domain safety scan revealing several red flags: it was registered with Dynadot Inc on November 24, 2025, and is currently resolving to IP address 188.114.97.3. Although the site currently shows 4/95 detections on VirusTotal as of the latest scan, phishing domains often bypass initial detection due to short operational lifespans and rapidly changing infrastructure. The use of a Let’s Encrypt SSL certificate does not indicate legitimacy, as threat actors frequently abuse free SSL services to appear trustworthy. Despite the absence of immediate signature matches, the combination of a recently registered domain, suspicious URL structure, and Tesla brand impersonation presents a high-risk threat profile. Users should avoid engaging with any unexpected links or emails referencing this domain. If you have already visited tesla.club.mchten-wxa or entered any login credentials, immediately change your Tesla account password and enable two-factor authentication. Log out of all active sessions from the Tesla security settings and monitor your account for unauthorized activity or financial transactions. Report the domain to Tesla’s official phishing reporting channels and run a comprehensive scan of your device using reputable security software to check for malware or credential-stealing Trojans. To prevent future exposure, always verify URLs by hovering over links before clicking and use PhishDestroy’s real-time domain lookup tool to confirm site authenticity. Avoid entering any personal or financial information on untrusted domains and report suspicious sites immediately to help protect the broader community from cyber threats.