ens0[.]click

ens0.click has been identified as a confirmed phishing site with a high risk level. The domain was created on March 13, 2026, and is currently active, resolving to the IP address 172.67.140.156. It has been observed on two security blocklists, indicating that it has been flagged by security researchers for malicious activity. Additionally, it has received a particularly low trust score of 0/100 from Gridinsoft, further supporting its classification as a threat. The page title "Just a moment..." suggests a possible loading screen typical of phishing attempts aimed at deceiving users into providing sensitive information.

The domain is registered through Sav.com, LLC, a registrar that has been used for various malicious domains in the past. Its presence on major threat intelligence platforms, including being cited in 23 threat intelligence pulses on AlienVault OTX, highlights its recognition within the cybersecurity community as a significant threat. Furthermore, analysis from VirusTotal shows that 15 out of 95 security vendors have flagged this domain, which reinforces the notion that it is engaged in phishing activities.

Given this evidence, defenders should take immediate action to block this domain at the network perimeter and ensure that users are adequately educated about the risks associated with such phishing attempts. Continuous monitoring of the domain's status and its associated IP address is recommended, as attackers often change infrastructure to evade detection. Organizations should also be cautious of any communications that may be linked to this domain and implement measures to identify and mitigate phishing threats in their environments.