9516[.]li

Analysis indicates that the domain 9516.li, registered on February 26, 1993, has been actively flagged as a generic phishing threat. As of July 25, 2026, the domain resolves to the IP address 103.86.46.165, hosted on AS138195 (MOACK.Co.LTD) in South Korea. Infrastructure analysis reveals the domain uses nameservers a.nic.li, b.nic.li, d.nic.li, e.nic.li, f.nic.li, sima.ns.cloudflare.com, and tony.ns.cloudflare.com, suggesting partial reliance on Cloudflare for DNS resolution. No SSL certificate is present, increasing the risk of unencrypted credential interception.

Detection data shows the domain appears on one security blocklist and is flagged by 12 of 93 security vendors in VirusTotal scans, though the exact nature of the phishing content remains unconfirmed. AlienVault OTX records the domain in one threat intelligence pulse, while Gridinsoft assigns a trust score of 0/100, reinforcing its classification as malicious. The domain was taken offline following detection, though defenders should remain cautious of potential re-emergence under similar infrastructure.

The registrar and hosting provider details do not specify a targeted brand or service, and no page title or phishing kit information is available in the current intelligence. Organizations are advised to block the domain and associated IP (103.86.46.165) at the network level, monitor for related DNS queries, and verify endpoint logs for connections to this infrastructure. Given the domain's age and recent malicious activity, further investigation into historical resolutions and subdomains is recommended.