v35w[.]top

This domain, v35w.top, is identified as a credential harvesting phishing site targeting user authentication data. Analysis confirms the domain is currently offline, though prior activity suggests it was designed to mimic legitimate login portals to capture sensitive credentials. No specific brand impersonation has been conclusively linked, but the infrastructure aligns with known phishing campaigns focused on credential theft. Infrastructure analysis reveals the domain was registered through NameMart Pte. Ltd. on May 15, 2026, and resolves to the IP address 154.39.104.130, hosted under AS18186 (Nebula Global LLC) in Hong Kong. Detection metrics indicate the domain was flagged by 18 of 95 security vendors on VirusTotal, while appearing on a single security blocklist. The SSL certificate, issued by Let's Encrypt (R13), further corroborates its use in transient phishing operations, a common tactic to evade immediate detection. Current status confirms v35w.top has been taken offline, though residual risk may persist for users who interacted with the domain prior to its deactivation. Organizations are advised to block the domain and associated IP (154.39.104.130) at the network perimeter. End users should verify any prior logins associated with this domain and rotate credentials if exposure is suspected. Monitoring for related domains registered under the same registrar or IP range is recommended to preempt potential follow-up campaigns.