f28i[.]top

Analysis of the domain f28i.top indicates active phishing infrastructure with a high-risk classification. Registered on May 18, 2026, through NameMart Pte. Ltd., the domain currently resolves to the IP address 103.27.177.164. As of July 18, 2026, the domain remains operational and is flagged by 13 of 95 security vendors on VirusTotal, suggesting malicious intent. It appears in two threat intelligence pulses on AlienVault OTX and is blocked by OpenPhish, further corroborating its association with phishing activity. The domain is also listed on one security blocklist. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites, providing no definitive indication of intent. No specific brand impersonation or scam category has been identified in available intelligence, and the exact content or target of the phishing site remains unconfirmed. Defenders are advised to treat this domain as hostile infrastructure. Network-level blocking of the domain and its associated IP address (103.27.177.164) is recommended for organizations seeking to mitigate exposure. Continuous monitoring for updates to threat intelligence sources is advised, as additional details regarding the phishing campaign may emerge.