teslapremiumfinance[.]com

teslapremiumfinance.com is a phishing domain actively targeting Tesla customers. Despite its recent creation on 2024-12-18, it already has 2 out of 91 VirusTotal vendors flagging it as malicious. The domain is registered with Dynadot Inc and hosted on an IP address (198.251.89.144) managed by FranTech Solutions in the United States.

The domain employs cloaking techniques, with a score of 3/10, meaning it serves benign content to scanners while potentially delivering malicious content to unsuspecting users. This tactic helps the domain evade detection and prolong its malicious activity. PhishDestroy added it to its public blocklist on 2026-06-22, highlighting its threat to users.

teslapremiumfinance.com uses a Let's Encrypt SSL certificate, which is common among phishing sites due to its free and automated issuance process. This can give a false sense of security to users who see the padlock symbol in their browser. The combination of a legitimate-looking domain name and SSL certificate increases the likelihood of users falling victim to this scam.

The domain's presence in only one public blocklist, despite being flagged by VirusTotal, suggests it is relatively fresh and may not yet be widely recognized as a threat. PhishDestroy's early detection underscores the importance of proactive threat monitoring to identify and mitigate risks before they propagate through traditional security channels.