ex-test-domain[.]click

This domain, ex-test-domain.click, is flagged as a generic phishing threat designed to harvest user credentials through fake login portals. Victims are typically redirected to a spoofed authentication page that mimics legitimate services, where entered credentials are captured and transmitted to threat actors. The site may also distribute malware or initiate unauthorized transactions if additional sensitive data, such as multi-factor authentication codes, is provided. Analysis indicates the domain was registered on April 26, 2026, through Global Domain Group LLC, a registrar frequently associated with malicious infrastructure. VirusTotal reports 0 detections out of 95 engines, suggesting the threat is either new or employs evasion techniques to avoid detection. The domain resolves to the IPv6 address 2606:4700:3035::6815:e4f and is currently offline, returning a 522 connection timeout error. It appears on one security blocklist and has been included in a single AlienVault OTX threat intelligence pulse, further corroborating its malicious nature. Users who visited ex-test-domain.click should immediately revoke any active sessions on accounts accessed during the visit. Change passwords for all potentially compromised credentials, prioritizing financial, email, and work-related accounts. Enable multi-factor authentication where available, using app-based or hardware tokens instead of SMS. Monitor accounts for unauthorized transactions or login attempts and report any suspicious activity to the affected service provider. If the site was accessed on a corporate device, notify the internal security team to conduct a forensic review and contain potential lateral movement.