x16c[.]top

Analysis of the domain x16c.top confirms its classification as an active credential phishing site, as of July 12, 2026. The domain was registered on May 18, 2026, through NameMart Pte. Ltd., and currently resolves to the IP address 154.39.104.142, hosted in Hong Kong under the provider StarCloudGlobal-HK. Infrastructure review reveals the use of four nameservers (ns1.1111343.com through ns4.1111343.com), a pattern often associated with bulletproof or low-reputation hosting configurations. Security vendors have flagged this domain, with 19 out of 92 engines on VirusTotal detecting malicious activity, and it appears on at least one blocklist, specifically PhishDestroy. The domain has also been documented in a threat intelligence pulse on AlienVault OTX, further corroborating its malicious status. A Let's Encrypt SSL certificate (R12) is in place, providing HTTPS encryption, which is commonly exploited by phishing sites to appear legitimate. The HTTP status code 200 indicates the site is currently accessible and serving content, though the exact nature of the phishing page—such as targeted brands or specific lures—has not been analyzed in detail. Defenders should prioritize blocking this domain at the DNS and network level, as well as monitoring for connections to its associated IP address (154.39.104.142). Given the domain's recent registration and active status, it is likely part of a broader phishing campaign. Organizations are advised to review logs for any user interactions with this domain or its infrastructure, particularly credential submission attempts. No additional details regarding the phishing kit or targeted entities are available at this time.