f37p[.]top

Analysis of the domain f37p.top indicates an active credential harvesting operation that surfaced on June 22, 2026. The domain resolves to the IPv4 address 103.27.177.164 and is serviced by four name servers (ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, ns4.1111343.com) registered through NameMart Pte. Ltd. VirusTotal records show that seven of ninety-five scanned security vendors have flagged the domain, suggesting that multiple detection engines have identified malicious behavior. The domain is currently listed on a single public blocklist and has been explicitly blocked by the PhishDestroy platform, reinforcing its classification as a high‑risk phishing vector. AlienVault OTX references the domain in two separate threat pulses, providing additional corroboration of its malicious use. Although the exact phishing payload or targeted brand has not been publicly disclosed, the convergence of vendor detections, blocklist presence, and OTX mentions confirms that f37p.top is being leveraged for credential theft. Defenders should enforce DNS‑level blocking of the domain and its associated IP address, monitor outbound connections to the listed name servers, and incorporate the domain into endpoint and email security rule sets. Continuous re‑evaluation is advised, as threat actors may alter hosting or content, but the current intelligence baseline warrants immediate preventive controls.