web160526-a1[.]xyz

PhishDestroy identifies an active credential theft campaign impersonating a web portal via domain web160526-a1.xyz. This infrastructure is designed to harvest user login credentials under the guise of a legitimate service, exposing victims to direct account compromise. This domain, registered on May 16, 2026, through NameSilo, LLC, resolves to IP address 35.168.40.172 and is protected by a Let's Encrypt SSL certificate. VirusTotal analysis shows 15 out of 95 detection engines flagged the domain, indicating low detection coverage despite its malicious intent. Google Safe Browsing has already classified the site under the SOCIAL_ENGINEERING category, confirming early suspicious classification. The combination of recent registration, lack of AV coverage, and active blocklisting signals emerging threat activity. If you accessed web160526-a1.xyz or entered credentials, immediately change passwords on all related accounts and enable two-factor authentication. Run a full antivirus scan on your device. Do not re-enter any data on this domain. Report the site to your security provider and consider blocking both the domain and IP 35.168.40.172 to prevent further exposure.