s23i[.]top

Analysis of s23i.top indicates a high-risk credential-phishing domain registered on May 18, 2026, through NameMart Pte. Ltd. The domain remains active as of July 18, 2026, and resolves to the IP address 103.27.177.164. It is currently flagged by OpenPhish and appears on one security blocklist. Infrastructure review shows the domain uses a Let's Encrypt SSL certificate, a common choice for both legitimate and malicious sites, which does not inherently confirm or refute malicious intent. Threat intelligence sources report the domain in two AlienVault OTX pulses, suggesting prior association with malicious campaigns. Twelve of 95 security vendors on VirusTotal have flagged the domain as malicious, though the specific nature of the threat—whether credential harvesting, malware distribution, or other—has not been fully classified in available data. No brand impersonation or phishing kit details have been confirmed at this stage; the exact content of the site remains unanalysed. Defenders should treat this domain as an active phishing threat. Network-level blocking is recommended, particularly for organisations with users potentially targeted by credential-theft campaigns. Monitoring for connections to 103.27.177.164 may help identify compromised endpoints. Further analysis of the site’s content and associated infrastructure is advised to determine the precise phishing mechanism and any targeted brands or services.