f38g[.]top

This domain, f38g.top, is under active investigation for phishing activity as of July 21, 2026. Registered on June 26, 2026, through NameMart Pte. Ltd., the domain currently resolves to the IP address 103.27.177.163. Infrastructure analysis reveals it uses four nameservers: ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, and ns4.1111343.com, which may indicate shared or bulletproof hosting infrastructure often associated with malicious campaigns. The domain appears on one security blocklist and is actively blocked by PhishDestroy, suggesting prior detection of suspicious behavior. While no vendor detections were recorded in the most recent scan, the absence of detections does not confirm safety, particularly given the domain's recent registration and presence on a blocklist. Defenders should treat this domain as high-risk until further analysis confirms its legitimacy or malicious intent. Immediate actions include monitoring network traffic for connections to 103.27.177.163 or the domain itself, reviewing logs for any user interactions, and considering proactive blocking at the DNS or firewall level. The exact content or target of the phishing site remains unconfirmed, as no specific brand, page title, or scam type has been identified in available intelligence. Further investigation, including SSL certificate analysis, HTTP response inspection, and sandboxed interaction, is recommended to determine the domain's purpose and potential threat to users.