p26u[.]top

This domain, p26u.top, is actively flagged as a high-risk credential-harvesting phishing site. Registered on May 18, 2026, through NameMart Pte. Ltd., the domain remains operational as of July 18, 2026, resolving to the IP address 103.27.177.164. Infrastructure analysis reveals the use of a Let's Encrypt SSL certificate, a common tactic to lend superficial legitimacy to phishing pages. The domain appears in two threat intelligence pulses on AlienVault OTX and is listed on one security blocklist, with additional detections by OpenPhish. Seventeen of ninety-five security vendors on VirusTotal have flagged this domain, indicating broad consensus among detection engines regarding its malicious nature. The domain's recent creation and immediate association with phishing activity suggest a deliberate setup for short-term malicious campaigns. While the exact brand or service being impersonated is not yet confirmed in available data, the classification as a credential-harvesting site is supported by its inclusion in phishing-specific threat feeds. Defenders should treat this domain as hostile and implement blocking measures at the DNS or network level. Monitoring for related infrastructure, such as sibling domains or adjacent IPs, is recommended to identify potential campaign expansion. Given the domain's persistence and active status, continued vigilance is warranted.