tesitost[.]icu

Analysis of the domain tesitost.icu as of July 24, 2026 indicates that the site is currently offline but exhibits several indicators consistent with a malicious phishing infrastructure. The domain resolves to the IP address 172.67.175.85, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. Hosting on a shared CDN such as Cloudflare is common among abuse operators seeking to hide origin servers and benefit from built‑in DDoS mitigation. The domain appears on one public security blocklist and is specifically listed by PhishDestroy, confirming that at least one anti‑phishing service has taken action against it. TLS provisioning uses a certificate identified as WE1; the certificate details are not disclosed, but the presence of a valid SSL layer does not mitigate the observed risk.

A request to the site returned the title "Just a moment…", which is a generic placeholder often associated with Cloudflare challenge pages rather than a legitimate service page. Registration was performed through Web Commerce Communications Ltd, with the creation timestamp recorded as July 31, 2025. VirusTotal reports that two of ninety‑three scanning vendors flagged the domain, indicating a modest but non‑trivial detection rate. Gridinsoft assigns a trust score of zero out of one hundred, representing an extreme lack of confidence in the domain’s safety.

The exact payload, targeted brand, or phishing kit employed by the site cannot be derived from the available evidence; the page content beyond the title has not been captured. Defenders should continue to block the domain at the network perimeter, ensure that DNS filtering includes the known IP address 172.67.175.85, and monitor for any resurgence of the domain or related subdomains. Because the infrastructure resides on Cloudflare, threat actors could migrate to alternative IPs within the same ASN, so threat‑intel feeds should be consulted for updates.