v1-security[.]info

Analysis of v1-security.info, observed as an offline domain as of the report date, indicates a brand‑impersonation operation aimed at wallet or seed credential theft. The domain was registered on December 1 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and delegated to Cloudflare name servers nora.ns.cloudflare.com and yoxall.ns.cloudflare.com. DNS resolution points to IP 89.23.107.128, which belongs to AS215540 GLOBAL CONNECTIVITY SOLUTIONS LLP in the Netherlands. No TLS certificate is presented for the host, meaning HTTPS connections are not available.

The site title returned from the last known HTTP response reads “AML Scanner for Crypto,” a phrase commonly used to attract cryptocurrency users. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist, specifically PhishDestroy. VirusTotal scans report 14 of 95 antivirus engines flagging the domain, confirming malicious characteristics. AlienVault OTX references the domain in one threat‑intel pulse, further corroborating its abuse.

The listed scam type is “Wallet/Seed Phishing,” and the impersonated brand is identified as “across.” Because the host is currently offline, the exact content and any credential‑capture mechanisms cannot be verified, creating uncertainty about the current payload. Defenders should continue to block the IP address 89.23.107.128 at network perimeters, enforce DNS‑based denial for v1-security.info, and add the domain to internal blacklist feeds. Continuous monitoring of the domain’s DNS records and registration status is advised to detect any re‑hosting or changes in the authoritative name servers that could reactivate the threat.