app[.]v1-debirdge[.]run

Analysis shows that app.v1-debirdge.run was created on 18 December 2025 through NiceNIC International Group Co., Limited and resolves to the Cloudflare‑owned address 188.114.96.3 (AS13335, United States). The host returns an HTTP 403 Forbidden response and does not present an SSL/TLS certificate, indicating that the site was not serving encrypted content at the time of observation. Gridinsoft assigns a trust score of 0 / 100, and Google Safe Browsing classifies the URL as a social‑engineering threat. VirusTotal reports six detections out of ninety‑five scanned engines, and the domain is listed on the PhishDestroy and ScamSniffer blocklists.

The page title captured during the scan was “403 Forbidden”. Nameservers are bingo.ns.cloudflare.com and curt.ns.cloudflare.com, consistent with the Cloudflare front‑end. Current status is offline, but historical presence on blocklists suggests the domain was used for a seed‑phrase phishing kit.

Defenders should immediately block the domain and its resolving IP at perimeter and endpoint controls, ensure that URL filtering solutions reference the identified blocklists, and monitor for any re‑registration or resurrection of the domain. Because the site lacked TLS, traffic inspection can be performed without decryption complications. Continuous review of Cloudflare‑hosted IP ranges for suspicious activity is advised, and security teams should update phishing awareness material to include seed‑phrase lures tied to this indicator.