testserveren[.]com

testserveren.com is currently flagged as a generic phishing infrastructure. VirusTotal records show that five of ninety‑one scanned antivirus and URL‑reputation engines have raised detections against the domain, indicating that at least a subset of security products consider it malicious. The domain also appears on a single public blocklist and is explicitly blocked by the PhishDestroy feed, confirming that community‑driven anti‑phishing sources have identified it as hostile. Registration data reveals the domain was created on 15 February 2016 through Realtime Register B.V., and it continues to resolve to the IPv4 address 46.250.221.19. Both authoritative name servers, ns1.proisp.no and ns2.proisp.no, are hosted by the Norwegian provider ProISP, suggesting the hosting environment is stable and has been in use for several years.

The persistent active status, combined with the detection counts, implies an ongoing campaign rather than a short‑lived test. No public information is available about SSL certificate details, HTTP response codes, or page title, so the exact content served by the site remains unknown. Defenders should therefore treat any traffic to or from testserveren.com as suspicious. Network‑level controls such as firewall deny rules or proxy blocklists should be updated to include the domain and its resolved IP address.

Email gateways should add the domain to block lists to prevent credential‑harvesting messages from reaching users. Continuous monitoring of the IP and DNS records is advised, as the operators may shift hosting or add new subdomains. Because the registrar is still active, a request for takedown could be pursued through Realtime Register B.V. if evidence of abuse is collected. Until further forensic analysis clarifies the payload, the recommendation is to block the domain globally and alert end users to avoid any unsolicited communications that reference it.