tentamail[.]net

This domain, tentamail.net, is actively engaged in generic phishing operations designed to harvest credentials through a fake login portal. The page title, Startseite | Testikus, suggests an attempt to impersonate German-language services or brands, potentially targeting users in German-speaking regions. Analysis of the infrastructure reveals the site employs social engineering tactics to deceive visitors into entering sensitive information, which may then be exfiltrated to attacker-controlled servers for malicious use, such as account takeovers or financial fraud. Infrastructure analysis indicates tentamail.net was registered on June 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 172.67.171.146 and is protected by an SSL certificate issued by Google Trust Services, which may lend an appearance of legitimacy to unsuspecting users. Detection metrics further underscore the threat: VirusTotal reports 1 out of 95 security vendors flagging the domain as malicious, while AlienVault OTX has recorded its presence in a single threat intelligence pulse. Despite these indicators, the domain remains operational, increasing the risk of exposure for potential victims. Users who have visited tentamail.net or interacted with its content are advised to take immediate remedial action. First, any credentials entered on the site should be considered compromised and must be changed across all platforms where identical or similar passwords were used. Second, affected systems should undergo a thorough security scan to detect potential malware or unauthorized access. Finally, organizations and individuals are encouraged to block the domain and its associated IP address, 172.67.171.146, at the network level to prevent further exposure. Vigilance is critical, as phishing domains of this nature often employ short-lived infrastructure to evade detection.