p27t[.]top

The domain p27t.top was registered on May 21, 2026 through NameMart Pte. Ltd. and has since been identified as part of a credential‑harvesting operation. Early detection by the PhishDestroy service resulted in the domain being blocked, and it currently appears on one public security blocklist. VirusTotal analysis shows that 17 of 91 scanning engines have flagged the domain, indicating a consensus of malicious intent among a subset of antivirus and URL‑reputation products.

No additional infrastructure details such as IP address, hosting provider, SSL certificate information, HTTP response codes, or page title have been disclosed in the available intelligence, so the full attack surface remains partially unknown. Defenders should prioritize adding p27t.top to URL filtering and DNS‑sinkhole policies, monitor outbound traffic for connections to the domain, and incorporate the domain hash into existing threat‑intel feeds. Continuous re‑scanning with VirusTotal and other sandbox services is advised to capture any evolution in payload or hosting.

Organizations that rely on credential‑based authentication should enforce multi‑factor authentication and educate users about unsolicited login prompts that may reference the domain. The combination of registrar data, blocklist presence, and the 17/91 detection ratio provides sufficient evidence for an elevated risk rating and justifies immediate mitigation actions.