1lnch[.]fi-v2[.]to

Analysis of the domain 1lnch.fi-v2.to, created on 17 November 2025 and currently taken offline, indicates it is part of a generic phishing campaign. The domain resolves to the Cloudflare address 172.67.172.31, belonging to AS13335 in the United States. Nameservers listed are desiree.ns.cloudflare.com and valentin.ns.cloudflare.com, confirming Cloudflare hosting. The registrar is recorded as the Government of Kingdom of Tonga, a pattern often observed in malicious registrations that exploit lax oversight. No TLS certificate is presented, meaning the site operates without HTTPS, reducing transport‑level authentication.

Reputation services assign extremely low trust scores: Scamadviser rates the domain 1 / 100 and Gridinsoft 0 / 100. The domain appears on one security blocklist and has been explicitly blocked by PhishDestroy. VirusTotal scans show that 16 of 95 antivirus and URL‑reputation engines flag the domain as malicious, providing independent corroboration of its threat status. The page title returned by the server is simply “1lnch.fi-v2.to”, offering no indication of a targeted brand or lure. Because the site is offline, active probing is limited, and the exact phishing kit or credential‑harvesting mechanism remains unknown.

The presence on a single external blocklist indicates limited community awareness, but the multi‑vendor detection on VirusTotal suggests a broader consensus of malicious intent. Absence of SSL and the generic page title further reduce legitimacy. The lack of publicly available Safe Browsing or OTX entries means that data sources may not yet have propagated the indicator, highlighting the need for manual IOC sharing. Defenders should continue to block the domain at perimeter firewalls and DNS filtering solutions, monitor for any re‑hosting attempts that may use the same IP or Cloudflare nameservers, and add the domain to internal threat‑intel feeds.