play-tesco[.]lol

This domain, play-tesco.lol, is flagged as a generic phishing site designed to impersonate Tesco, a major retail brand. Analysis indicates the domain was likely created to deceive users into believing they are interacting with a legitimate Tesco rewards or loyalty program portal. No specific drainer kit signatures have been identified, but the infrastructure aligns with credential harvesting and payment data theft campaigns. The domain employs social engineering tactics, such as fake discounts or prize offers, to lure victims into submitting sensitive information. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 188.114.97.3 and was registered through NAMECHEAP INC on June 12, 2026. It uses a Let's Encrypt SSL certificate to create a false sense of security, while HTTP/3 and Cloudflare technologies are employed to obfuscate the true origin and evade detection. The domain is flagged by 5 out of 95 security vendors on VirusTotal, appears in 4 AlienVault OTX threat intelligence pulses, and is listed on one security blocklist. Google Safe Browsing (GSB) does not currently list the domain, which may have contributed to its initial evasion of widespread detection. As of the latest assessment, play-tesco.lol has been taken offline, likely due to enforcement actions or the expiration of its hosting resources. It was blocked by at least one security provider, indicating proactive mitigation efforts. However, the risk remains elevated for users who may have interacted with the domain prior to its takedown, as credentials or payment data submitted during that period could still be exploited. Organizations and individuals are advised to monitor for unauthorized access attempts, reset credentials associated with Tesco accounts, and implement multi-factor authentication (MFA) to mitigate residual risk. Network defenders should update blocklists to include this domain and its associated IP address to prevent future access attempts.