e[.]v1-lend[.]run

The domain e.v1-lend.run was observed resolving to 172.67.141.197, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The domain is registered through NiceNIC International Group Co., Limited and was created on 18 December 2025. No SSL certificate was presented during the scan, indicating the site was served over plain HTTP. The HTTP response returned a generic directory listing with the page title "Index of /", which provides no functional content. The infrastructure is protected by Cloudflare's DNS service, using the authoritative nameservers bingo.ns.cloudflare.com and curt.ns.cloudflare.com.

Reputation checks show a Gridinsoft trust score of 0 out of 100, and the domain is listed on at least one public security blocklist. VirusTotal analysis recorded four positive detections out of ninety‑three scanners, and the domain is actively blocked by the PhishDestroy feed. The current operational status is offline, suggesting the phishing campaign may have been taken down or is temporarily inactive. The presence of four detections on VirusTotal indicates that at least a subset of anti‑malware engines recognized malicious behavior, though the specific signatures or families were not disclosed. No evidence of a valid SSL certificate or HSTS policy was observed, which reduces the credibility of any login interface that might have been hosted.

Because the site returned only a directory index, the actual malicious content may have been hosted on deeper paths that were not captured before the takedown. Analysts should therefore treat the domain as a potential dropper for additional phishing pages and monitor for any new URL paths that resolve to the same IP. Correlation with other recent phishing incidents that share the same Cloudflare edge IP could reveal a broader campaign. Until the domain is definitively confirmed clean, it should remain on blocklists and be flagged in email and web gateway security policies.