20401[.]academy

The domain 20401.academy was registered on 21 February 2026 through Dynadot LLC and is currently listed as offline. The authoritative nameservers 5014.ns1.abovedomains.com and 5014.ns2.abovedomains.com resolve the domain to the IPv4 address 23.225.199.94, which belongs to AS40065 operated by CNSERVERS LLC and is geolocated in the United States. The site presented a TLS certificate issued by Let’s Encrypt (R13) and, when accessed, returned the HTTP status “504 Gateway Timeout”, indicating that the backend service was unavailable at the time of observation.

The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy filtering service. VirusTotal analysis shows that one out of ninety‑three scanned security vendors flagged the domain, providing a minimal but non‑zero indication of malicious behavior. The overall risk rating is elevated, and the threat classification is generic phishing, though the specific lure or targeted brand has not been identified in the available data.

Defenders should continue to monitor the associated IP address and ASN for any reactivation, enforce blocklist rules for 23.225.199.94, and consider adding the domain to internal deny lists. Because the site is offline, dynamic analysis is not possible, and further investigation should focus on historical traffic captures, WHOIS change history, and correlation with other campaigns that use the same hosting provider or certificate issuance pattern.