v1-mev[.]sbs

This domain, v1-mev.sbs, poses a targeted phishing threat designed to impersonate Maximal Extractable Value (MEV) bot interfaces, likely targeting cryptocurrency users and validators. The site mimics legitimate MEV infrastructure to deceive victims into entering wallet credentials or executing malicious smart contracts, potentially leading to unauthorized fund transfers or token theft. Analysis of the domain reveals it was engineered to exploit the growing adoption of MEV strategies in blockchain ecosystems, where users frequently interact with third-party tools for arbitrage or transaction ordering. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain is flagged by 9 out of 95 security vendors on VirusTotal, with detections spanning phishing, fraud, and cryptocurrency-related threats. Registered on December 05, 2025, through NiceNIC International Group Co., Limited, the domain resolves to IP address 172.67.196.50 and employs Cloudflare for hosting, a common tactic to obfuscate origin servers. It appears on one security blocklist and was previously blocked by enterprise-grade threat intelligence feeds. The SSL certificate, issued by Google Trust Services, further suggests an attempt to mimic legitimate services, though the domain has since been taken offline, returning a 522 connection timeout error. Users who visited v1-mev.sbs should immediately revoke any smart contract approvals granted during the interaction, particularly those involving ERC-20 tokens or wallet permissions. Cryptocurrency wallets should be audited for unauthorized transactions, with a focus on high-value token transfers or unexpected contract interactions. If credentials were entered, users must assume compromise and rotate all associated passwords and private keys. Network-level indicators, including the domain and its resolving IP (172.67.196.50), should be added to firewall or endpoint protection rules to prevent future access. Monitoring for follow-up phishing attempts via email or messaging platforms is recommended, as this domain may be part of a broader campaign.