m20v[.]top

Analysis of the domain m20v.top, created on May 26, 2026, indicates active infrastructure supporting a high‑risk generic phishing operation. The domain is registered through NameMart Pte. Ltd. and is served by four authoritative name servers (ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, ns4.1111343.com). DNS resolution points to the IPv4 address 103.27.177.163, which currently hosts the malicious payload.

VirusTotal scans have recorded five detections out of ninety‑five security vendors, confirming that a subset of scanners identifies the domain as malicious. The domain appears on one public security blocklist and is explicitly blocked by the PhishDestroy service, reinforcing its classification as a phishing threat. No additional intelligence such as SSL certificate details, HTTP response codes, page title, or brand targeting is presently available, leaving the exact content and impersonated entity unverified.

Defenders should prioritize immediate mitigation by adding m20v.top to DNS blocklists, firewall deny rules, and endpoint protection exclusions. Continuous monitoring of the associated IP address and its surrounding CIDR block is advised to detect potential lateral movement or additional malicious deployments. Given the high risk rating and active status, organizations are encouraged to update threat intelligence feeds with this indicator set and to educate users about unsolicited communications that may reference this domain.