e[.]v3-lend[.]top

Analysis of e.v3-lend.top indicates that the domain is currently offline but exhibits multiple indicators of malicious activity consistent with generic phishing. The domain resolves to the IP address 172.67.156.57, which belongs to AS13335 Cloudflare, Inc., located in the United States. The registration record shows the domain was created on 7 December 2025 through NiceNIC International Group Co., Limited, and uses Cloudflare’s authoritative nameservers bingo.ns.cloudflare.com and curt.ns.cloudflare.com. No TLS certificate is presented for the host, and an HTTP request returns the generic directory listing page titled “Index of /”, which provides no substantive content for further verification. Reputation data shows the domain appears on one security blocklist and is explicitly blocked by the PhishDestroy feed.

VirusTotal scans report that three of ninety‑five antivirus engines have flagged the domain, reinforcing the suspicion of malicious intent. Additionally, Gridinsoft assigns a trust score of 0 out of 100, indicating a complete lack of confidence in the domain’s legitimacy. The combination of a recent registration, lack of encryption, low trust score, blocklist presence, and multiple vendor detections strongly suggests that e.v3-lend.top was used for phishing attempts before being taken offline. Because the site is no longer serving content, direct behavioral analysis is limited.

However, defenders should continue to block the domain at perimeter and DNS filtering layers, monitor the associated IP address for any future re‑use, and consider adding the IP to threat intel feeds. Ongoing observation of the Cloudflare nameservers may reveal re‑registration of the domain for new campaigns. Organizations that have observed traffic to this host should investigate any credential submissions that occurred prior to the takedown and enforce credential reset procedures where appropriate.