f31d[.]top

Analysis indicates that the domain f31d.top was registered on June 01, 2026 through NameMart Pte. Ltd. The domain resolves to the IPv4 address 103.27.177.163 and is served by four authoritative name servers (ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, ns4.1111343.com). The registration date places the infrastructure within a recent window, suggesting a rapid deployment typical of phishing campaigns. The domain is currently listed as active and has been added to at least one public security blocklist. PhishDestroy, a known anti‑phishing feed, has already flagged the host, and VirusTotal reports that seven of ninety‑five scanning engines have generated a detection for the domain, reinforcing the malicious classification. No public page title, SSL certificate details, or explicit brand impersonation have been disclosed in the available intelligence, leaving the exact content of the landing page unverified. Consequently, the precise victim‑targeting vector cannot be confirmed at this time. However, the combination of recent creation, dedicated name servers, and detection by multiple vendors aligns with observed patterns for generic phishing infrastructure. Defenders should prioritize immediate containment of traffic to f31d.top. Recommended actions include adding the domain to DNS‑based deny lists, updating firewall and proxy rules to block HTTP/HTTPS connections, and configuring endpoint protection to treat the associated IP address 103.27.177.163 as malicious. Continuous monitoring of the four name servers for new sub‑domains is advised, as attackers frequently leverage the same authoritative infrastructure for additional campaigns. Organizations that employ threat‑intel feeds should ensure that the blocklist entry from PhishDestroy and the VirusTotal detection are propagated throughout their security stack.