f[.]v1-network[.]run

f.v1-network.run is a subdomain of v1-network.run. PhishDestroy first observed the hostname on Dec 20, 2025. The captured page title is “403 Forbidden”. Campaign clustering links the hostname to the Seed Phrase Phishing kit. Current evidence score: 65/100 (high).

Positive findings are stored from 2 sources: VirusTotal and Spamhaus DBL. VirusTotal recorded 5 detections among 95 engines: ChainPatrol, CyRadar, Forcepoint ThreatSeeker, Fortinet, SOCRadar on Jun 16, 2026 at 22:32 UTC. Spamhaus DBL: DBL_PHISH on Jul 14, 2026 at 14:33 UTC. Non-positive and contextual checks: The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 14:20 UTC. URLQuery recorded no positive detection; no observation timestamp was retained. Google Safe Browsing returned no flag on Mar 3, 2026 at 04:14 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 03:30 UTC.

HTTP 502 was recorded on Aug 8, 2026 at 02:32 UTC; content was unavailable. Latest classified outcome: registration hold observed; cause registrar client hold; mechanism client hold; observed actor NICENIC INTERNATIONAL GROUP CO., LIMITED on Aug 8, 2026 at 02:29 UTC. Registration records for the registrable domain v1-network.run list NiceNIC International Group Co., Limited as the registrar and Dec 17, 2025 as the creation date. Registration preceded first observation by 2 days. At collection time, the hostname resolved to 172.67.188.89 on AS13335 (CLOUDFLARENET, US). The IP and ASN identify shared Cloudflare edge infrastructure; the origin server is not established by this address. DOM analysis on Apr 23, 2026 at 07:23 UTC returned 0/100; the source detections above were recorded separately. The evidence archive retains 3 visual captures from PhishDestroy and URLScan.

The content indicators and 2 positive source findings support the current phishing classification. The stored fields do not identify an impersonated brand or victim interaction.