m2sv[.]top

m2sv.top is currently classified as a high‑risk generic phishing domain. The site was registered on 22 October 2025 through Dynadot LLC and resolves to the IPv4 address 217.154.177.94, which belongs to AS8560 IONOS SE located in Spain. DNS resolution is served by the Cloudflare authoritative name servers aria.ns.cloudflare.com and arturo.ns.cloudflare.com. An active TLS certificate issued by Let’s Encrypt (R12) is presented, and HTTP requests return a 200 status code. The page title returned by the web server is “m2sv.top”, but no further content analysis is available. VirusTotal has recorded detections from 17 of 95 scanned security vendors, indicating a notable level of malicious confidence. The domain appears on two independent blocklists, specifically PhishDestroy and ScamSniffer, and has been referenced in a single AlienVault OTX pulse. Gridinsoft reports a trust score of zero out of one hundred. All observed indicators point to an operational phishing infrastructure that is still active as of the report date. Because the underlying payload and target brand have not been disclosed, the precise phishing vector remains uncertain. Defenders should add 217.154.177.94 and the domain m2sv.top to network and endpoint blocklists, enforce TLS inspection to capture any credential submission, and monitor DNS queries for the associated Cloudflare name servers. Continuous re‑evaluation is advised in case additional threat intelligence, such as payload samples or victim reports, becomes available.