y27v[.]top

The domain y27v.top was registered on May 21, 2026 through NameMart Pte. Ltd. and is currently resolvable to the IPv4 address 103.27.177.163. All four authoritative name servers—ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, and ns4.1111343.com—are hosted under the same third‑party provider, suggesting a single‑point of control for the malicious infrastructure. The domain appears on one security blocklist and is explicitly blocked by the PhishDestroy filtering service. VirusTotal analysis shows that five of ninety‑five scanning engines have flagged the domain, indicating that a minority of automated detection tools have identified it as malicious, while the majority have not yet generated a detection. No additional intelligence such as page title, SSL certificate details, or HTTP response codes was supplied, leaving the exact content and targeted brand of the site unverified. This lack of visible victim‑facing data limits the ability to attribute a specific brand impersonation, but the classification as generic phishing aligns with the observed indicators. Defenders should add y27v.top and its resolving IP address to outbound deny lists, monitor DNS queries for the listed name servers, and consider sinkholing the address to disrupt any credential‑harvesting activity. Continuous re‑evaluation is advised, as additional detection from security vendors or blocklist updates may provide further insight into the campaign’s scope and targets.