extra-checker[.]quest

This domain, extra-checker.quest, operates as a credential theft portal designed to harvest login credentials through deceptive verification interfaces. Analysis indicates the site mimics legitimate authentication flows, presenting users with fake login prompts that closely resemble trusted platforms. The objective is to capture usernames, passwords, and potentially multi-factor authentication codes, enabling unauthorized access to victim accounts across email, financial services, or corporate networks. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with abusive registrations. It resolves to the IP address 104.21.19.210 and is currently flagged by 3 of 95 security vendors on VirusTotal, with an additional blocklist presence on one security feed. The page title 'Just a moment...' suggests the use of anti-analysis techniques or proxy-based hosting, common in credential theft campaigns to evade detection and prolong operational lifespan. Users who visited extra-checker.quest or entered credentials on the site should immediately revoke any active sessions and change passwords for all potentially exposed accounts. Multi-factor authentication should be enabled where available, and credentials should not be reused across platforms. Monitoring for unauthorized access or anomalous activity is recommended, particularly for accounts linked to financial or sensitive personal data. If credentials were submitted, consider notifying relevant security teams or service providers to mitigate potential account compromise.