p35l[.]top

This domain is flagged as a credential harvesting phishing site designed to steal user login details, financial information, or other sensitive data. Analysis indicates the site mimics legitimate services, such as banking portals, email providers, or corporate login pages, to deceive visitors into entering confidential credentials. The infrastructure is optimized for rapid deployment and evasion, making it a persistent threat to individuals and organizations. Infrastructure analysis reveals the domain was registered on June 22, 2026, through NameMart Pte. Ltd., a registrar frequently associated with malicious activity. It currently resolves to the IP address 154.39.104.136, which hosts multiple phishing campaigns. Security vendors on VirusTotal have flagged this domain as malicious, with 11 out of 95 engines detecting it as a phishing threat. The SSL certificate, issued by Let's Encrypt, is valid but does not mitigate the underlying risk, as attackers commonly use legitimate certificates to appear trustworthy. If you or someone in your organization has visited p35l.top or entered credentials on this site, immediate action is required. Disconnect the affected device from the network to prevent potential lateral movement or data exfiltration. Reset all passwords associated with the compromised account, prioritizing email, financial, and administrative credentials. Enable multi-factor authentication (MFA) where available to add an additional layer of security. Monitor accounts for unauthorized transactions or suspicious activity, and report the incident to your organization’s security team or a trusted cybersecurity professional for further analysis.