security-click.click Fake Security Alert – Active Phishing

PhishDestroy identifies the live domain security-click.click as part of an active generic phishing campaign. The site carries a browser tab title identical to its domain name and appears to impersonate legitimate security portals, tricking users into clicking through to a drainer kit hosted on infrastructure linked to fraudulent payment capture. No evidence points to a specific brand trademark being abused at this time, but the site’s lures center on fabricated security warnings and urgent “login to secure account” prompts.

Technical indicators confirm elevated risk: Let's Encrypt issued the SSL certificate; the domain resolves to 188.114.97.3; VirusTotal detection stands at 13/95 security vendors; it was registered on April 24, 2026 through Global Domain Group LLC; and the domain appears on two blocklists maintained by OISD and Hagezi. The combination of a recent creation date, low VT coverage, and active blocklisting suggests early-stage deployment to evade takedowns.

The campaign remains active as of forensic review. Immediate recommended actions include blocking 188.114.97.3 at network perimeter devices and updating endpoint detections for the SHA-256 hashes associated with this domain, which can be extracted from the URL path captured in proxy logs. While the overall risk is elevated, the low VT score and narrow blocklist footprint indicate that most protective stacks have not yet cataloged this indicator. Users should avoid visiting security-click.click and report any accidental interactions to their security teams for credential reset and endpoint scans.