m28u[.]top

This domain, m28u.top, is under investigation for credential harvesting phishing activity. Registered on June 26, 2026, through NameMart Pte. Ltd., it currently resolves to the IP address 154.39.104.138. Infrastructure analysis reveals the use of nameservers ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, and ns4.1111343.com, which may indicate a pattern associated with malicious domains. The domain has been flagged in one threat intelligence pulse on AlienVault OTX, suggesting prior detection in security communities. As of July 18, 2026, the domain remains active, and no specific brand or kit has been confirmed in available intelligence. Defenders should treat this domain as high-risk for credential theft or related phishing schemes. Immediate action includes blocking the domain and associated IP at perimeter security controls, monitoring for internal connections to 154.39.104.138, and reviewing logs for any prior interactions. Further analysis of the site's content is required to determine the exact phishing mechanism or targeted brand, if any. Given the recent registration and active status, this domain warrants continued scrutiny and inclusion in threat hunting activities.