VirusTotal
6 / 91 engine detections
보고서 열기“Tes - Welcome to Tes-co”
The sent-report ledger records the first outgoing report at .
The recorded recipient is abuse@cosmotown.com.
The latest stored availability evidence still shows the domain reachable; 22 days has elapsed since the first outgoing report.
ICANN RAA §3.18 describes registrar abuse-contact and handling obligations. This section records outgoing timestamps, listed recipients, case identifiers, and later availability. It does not by itself prove receipt, acknowledgement, investigation, remediation, or contractual non-compliance.
Investmentscam 사칭: tesm.internezz.xyz — 마지막으로 알려진 활성 (HTTP 200). 증거 요약: VirusTotal 6/91 (alphaMountain.ai, ESET, Forcepoint ThreatSeeker, Fortinet, Netcraft)…
원본 포렌식 기록을 보존하기 위해 아래의 상세 PhishDestroy AI 분석은 영어로 유지됩니다.
6 / 91 engine detections
보고서 열기2 det.
보고서 열기DBL_SPAM
악성
보고서 열기no community references
보고서 열기provider verdict: clean
보고서 열기No threat flag
보고서 열기Results reflect each source’s collection time. Zero detections do not guarantee safety. OTX references are community publications.
PhishDestroy threat report
tesm.internezz.xyz is an impersonation phishing page whose title reads "Tes - Welcome to Tes-co", a lightly altered version of the Tesco name. urlscan.io tags its content as an investment scam, so the people at risk are those drawn in by promises of returns under a familiar retail brand. PhishDestroy first saw the site on 2026-09-29. On 2026-10-19 it was still online and serving its scam content.
Sites like this borrow a trusted brand to make a fake investment platform look legitimate. Visitors are invited to register, deposit money or crypto, and watch a dashboard show balances that keep growing. The gains are fictional. When victims try to withdraw, the operators demand extra "fees", "taxes" or bigger deposits, and in the end the money is not returned. Victims can also lose the personal details and login credentials they entered at sign-up.
Six of 91 VirusTotal engines flagged the domain as of 2026-10-01: alphaMountain.ai, ESET, Forcepoint ThreatSeeker, Fortinet, Netcraft and SOCRadar. That count is low, so many browsers and filters may still load the page without a warning. urlscan.io gave a malicious verdict and identified the investment-scam pattern. Spamhaus lists the domain in its DBL as spam, and PhishDestroy blocklists it.
The domain was registered on 2026-05-26 through TuringSign Inc. d/b/a Cosmotown, about four months before PhishDestroy detected it. That gap suggests the domain was set up ahead of the campaign. Scam content sits on a subdomain of a generic .xyz name rather than anything resembling the brand it copies. The site is hosted at 163.61.188.9 on the NEW DHAKA HARDWARE network in the US. It uses a free Let's Encrypt certificate, so the browser padlock says nothing about whether the site is legitimate.
Do not deposit anything, and do not pay any "withdrawal fee" or "unlock" charge the site or its agents demand, because further payments only add to the loss. If you already sent money, contact your bank or card issuer immediately to dispute the payment, and report the case to local police and your national fraud agency. If you reused a password when registering, change it everywhere, enable two-factor authentication, and treat unsolicited offers to "recover" your funds as a second scam. Defenders should block the domain and IP 163.61.188.9 and watch for other subdomains of internezz.xyz.
Stored page, network and scanner observations, grouped by source and observation time.
관측됨: · Retrieved:
| Uuid | 01a0ebaa-3772-713c-abb3-25f285305585 |
|---|---|
| Final url | https://tesm.internezz.xyz/ |
| 상태 | 200 |
| Ip | 163.61.188.9 |
| Ptr | s2.whitelabelclouds.com |
| Contacted domains | [
"www.tradingview-widget.com",
"s3-symbol-logo.tradingview.com",
"widget-sheriff.tradingview-widget.com",
"s3.tradingview.com",
"widgetdata.tradingview.com",
"snowplow-pixel.tradingview.com",
"cdn.gtranslate.net",
"unpkg.com",
"cdn.tailwindcss.com",
"scanner.tradingview.com",
"fonts.gstatic.com",
"cdn.jsdelivr.net",
"fonts.googleapis.com"
] |
| Contacted IP addresses | [
"185.111.111.156",
"32.187.242.91",
"18.64.211.106",
"108.138.26.38",
"185.111.111.158",
"192.178.183.94",
"185.111.111.155",
"104.26.13.42",
"104.18.0.22",
"104.17.207.5",
"172.67.68.11",
"142.250.154.95",
"163.61.188.9"
] |
| Asns | [
"212238",
"16509",
"15169",
"13335",
"153568"
] |
| Countries | [
"DE",
"US",
"BD"
] |
| Linked domains | [
"www.tradingview.com"
] |
| Document hash | 9d7178925b2cefb33b8a675881dc9cef10da2522d6bc18ac7f22fc2651584b95 |
| Globals | [
"requestResize",
"tailwind",
"lucide",
"/template.html",
"gtranslateSettings",
"showFakeAlert",
"Alpine",
"doGTranslate",
"alerts"
] |
| 쿠키 | [
"XSRF-TOKEN",
"trading_platform_session",
"_sp_ses.6222",
"_sp_id.6222",
"sp"
] |
| Storage keys | [
"theme"
] |
| Tls | {
"san": [
"tesm.internezz.xyz",
"www.tesm.internezz.xyz"
],
"cipher": "AES_128_GCM",
"issuer": "YR1",
"subject": "www.tesm.internezz.xyz",
"protocol": "TLS 1.3",
"valid_to": "2026-12-27T14:54:22Z",
"valid_from": "2026-09-28T14:54:23Z"
} |
| Domain age days | 0 |
| Apex age days | 125 |
| Tls age days | 0 |
| Tls valid days | 89 |
| Requests | 165 |
| Provider verdicts | {
"engines": {
"tags": [
"urlscan-ml",
"urlscan-ml-60c5e22"
],
"score": 94,
"malicious": true
},
"overall": {
"tags": [
"phishing"
],
"score": 100,
"brands": [
"investmentscam"
],
"malicious": true,
"categories": [
"phishing"
]
},
"urlscan": {
"tags": [
"phishing"
],
"score": 100,
"brands": [
"Investment Scam"
],
"malicious": true,
"categories": [
"phishing"
]
}
} |
| HTTP headers | {
"server": "LiteSpeed",
"content-type": "text/html; charset=UTF-8",
"x-powered-by": "PHP/8.3.27",
"x-frame-options": "SAMEORIGIN",
"x-content-type-options": "nosniff",
"referrer-policy": "strict-origin-when-cross-origin"
} |
관측됨: · Retrieved:
| Uuid | 9004e55f-f83d-4ec9-8538-ae54270de025 |
|---|---|
| Final url | https://tesm.internezz.xyz/ |
| 상태 | 200 |
| History | [
{
"url": "https://tesm.internezz.xyz/",
"status": 200
}
] |
| DOM structure hash | f7e191016a26d34a8321e484a2b7ba393449fe52db8332a5f6f54fc2b6c1fc3a |
| Document hash | 01bc5ce3d1596deafba8607c1f807ad0a6495a0d26eb606084c53c78304e0cca |
| Radar rank | {
"bucket": ">200000"
} |
| DNS records | [
{
"name": "tesm.internezz.xyz",
"type": "A",
"value": "163.61.188.9"
}
] |
| Dnssec valid | false |
| Ip | 163.61.188.9 |
| Registration record | {
"registrar": "TuringSign Inc. d/b/a Cosmotown",
"created": "2026-05-26T06:33:02Z",
"updated": "2026-06-17T19:47:19Z",
"expires": "2027-05-26T23:59:59Z",
"nameservers": [
"dns2.lytehosting.com",
"dns3.lytehosting.com",
"dns1.lytehosting.com",
"dns4.lytehosting.com"
]
} |
관측됨: · Retrieved:
| Vendor result counts | {
"timeout": 0,
"harmless": 52,
"malicious": 3,
"suspicious": 4,
"undetected": 33
} |
|---|---|
| Vendor labels | {
"CRDF": "malicious",
"ESET": "phishing",
"Fortinet": "spam",
"Netcraft": "malicious",
"Gridinsoft": "suspicious",
"alphaMountain.ai": "spam",
"Forcepoint ThreatSeeker": "suspicious"
} |
| Reputation | 0 |
| Categories | {
"alphaMountain.ai": "Spam, Suspicious (alphaMountain.ai)",
"Forcepoint ThreatSeeker": "phishing and other frauds"
} |
| 등록기관 | TuringSign Inc. d/b/a Cosmotown |
| 생성됨 | 2026-05-26T06:33:02Z |
| Expires | 2027-05-26T23:59:59Z |
| Updated | 2026-06-17T19:47:19Z |
| First seen | 2026-09-28T16:07:51Z |
| DNS records | [
{
"ttl": 14400,
"type": "A",
"value": "163.61.188.9"
},
{
"ttl": 14400,
"type": "TXT",
"value": "v=spf1 +a +mx +ip4:163.61.188.9 include:relay.serverfoundation.com ~all"
}
] |
| Dns at | 2026-09-29T09:37:16Z |
| Jarm | 29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae |
| Certificate | {
"san": [
"tesm.internezz.xyz",
"www.tesm.internezz.xyz"
],
"issuer": "Let's Encrypt / YR1",
"serial": "5f9d3f33b097df5bb2454f46646965dad7f",
"sha256": "40a9f26bdf164f3ffa9eaabf3b4bd077b5775adacf2c5ae8af793722bc757f8a",
"subject": "www.tesm.internezz.xyz",
"valid_to": "2026-12-27T14:54:22Z",
"valid_from": "2026-09-28T14:54:23Z"
} |
| Registration record | {
"registrar": "TuringSign Inc. d/b/a Cosmotown",
"registrar_iana_id": "1509",
"registrar_url": "https://www.cosmotown.com",
"created": "2026-05-26T06:33:02Z",
"updated": "2026-06-17T19:47:19Z",
"expires": "2027-05-26T23:59:59Z",
"status": [
"clientDeleteProhibited",
"clientRenewProhibited",
"clientTransferProhibited",
"clientUpdateProhibited"
],
"nameservers": [
"dns1.lytehosting.com",
"dns2.lytehosting.com",
"dns3.lytehosting.com",
"dns4.lytehosting.com"
],
"dnssec": "unsigned"
} |
For the registrable domain internezz.xyz behind this subdomain, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
dns1.lytehosting.comdns2.lytehosting.comdns3.lytehosting.comdns4.lytehosting.comLocation describes the IP network.
40a9f26bdf164f3ffa9eaabf3b4bd077b5775adacf2c5ae8af793722bc757f8awww.tesm.internezz.xyzSaved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Hostnames retained in the domain record or Certificate Transparency cache. A hostname alone does not establish current availability or malicious activity.
www.tesm.internezz.xyzDomain recordThe original observation time is not recorded for these hostnames.
Google PageSpeed Insights — mobile performance audit of tesm.internezz.xyz · checked Sep 29, 2026
An estimated time describes an observation window. It does not prove a registrar action or the exact moment a site became unavailable.
Dated changes retained by the monitor and source collectors. Newest observations appear first; source states are not proof of a takedown.
알 수 없음→live_content
content_served
알 수 없음→live_content
content_served
알 수 없음→live_content
content_served
알 수 없음→live_content
content_served
알 수 없음→live_content
content_served
알 수 없음→live_content
content_served
알 수 없음→live_content
content_served
알 수 없음→live_content
content_served
알 수 없음→live_content
content_served
알 수 없음→live_content
content_served
알 수 없음→live_content
content_served
알 수 없음→live_content
content_served
알 수 없음→live_content
content_served
알 수 없음→live_content
content_served
알 수 없음→live_content
content_served
알 수 없음→live_content
content_served
알 수 없음→live_content
content_served
5→6
6→5
3→6
접속 가능
No threat flag
View source6/91 engine detections
View sourcePD-20260929-ECF6F3
tesm.internezz.xyz
View sourcePage captured
View sourceCompare what a browser and a crawler receive, and check for Keitaro traffic routing.
tesm.internezz.xyz
PD-20260929-ECF6F3 Recipient: abuse@cosmotown.com 계정 자격 증명, 개인 정보 또는 결제 정보를 입력했거나 이 도메인에서 파일을 다운로드한 경우 즉시 조치를 취하세요. 다음은 사건을 신고하고 자신을 보호하는 데 도움이 되는 리소스입니다.
공식 사이버 범죄 연락처 또는 불만사항 초안 작성 →를 받으려면 국가를 선택하세요.
Template-based draft · optional AI wording assistance requires separate consent
Choose the steps that match what you shared. Keep a copy of this report alongside your own records.
Stop using the suspicious site. Open the real service through its official app or an address you already trust.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
tesm.internezz.xyz)비록 모든 세부 사항을 알지 못하더라도 — 어쨌든 신고를 하세요. 부분적인 정보라도 수사에 도움이 됩니다.
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
Further guidance: NIST · phishing responseFBI IC3 · reports & evidenceFTC · recovery scams
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.