p1[.]etop[.]click

This domain, p1.etop.click, is identified as a credential-harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates the domain is currently offline, though it previously hosted content designed to capture authentication credentials. No specific brand impersonation has been confirmed, but the infrastructure aligns with generic phishing campaigns aimed at financial or corporate account compromise. Infrastructure analysis reveals the domain resolves to the IP address 178.16.53.103, hosted under AS202412 (Omegatech LTD) in the Netherlands. The domain was registered on August 30, 2025, through Sav.com, LLC, and lacks an SSL certificate, increasing the likelihood of interception or detection. Security vendors on VirusTotal flagged the domain at a rate of 17 out of 95, while it appears on a single security blocklist. The page title, 'Site is created successfully!', suggests either a placeholder or a hastily deployed phishing kit, a common tactic in short-lived campaigns. Current status indicates the domain has been taken offline, reducing immediate exposure. However, the infrastructure remains a potential threat vector. Organizations are advised to block the domain and its associated IP (178.16.53.103) at the perimeter level, including firewalls and DNS filters. Endpoint protection should be updated to detect related indicators of compromise, such as the domain name and IP. Users who may have interacted with the domain should reset credentials for any accounts accessed during the exposure window, particularly if multi-factor authentication was not enabled. Continuous monitoring for related domains or IPs registered under the same ASN (AS202412) is recommended to preemptively mitigate similar threats.