v1-eig[.]top

Analysis indicates that the domain v1-eig.top remains active as of 12 July 2026 and is classified as a high‑risk brand‑impersonation campaign targeting x.com. The site presents the generic title “Welcome to nginx!” and returns an HTTP 308 redirect, suggesting that the underlying service is hosted behind Cloudflare infrastructure (AS13335) with HTTP/3 enabled. DNS resolution points to 172.67.149.123, a Cloudflare‑owned address located in the United States. The SSL certificate is issued by Google Trust Services under the WE1 brand, confirming the use of a valid TLS chain. Registration details show the domain was created on 5 December 2025 through NiceNIC International Group Co., Limited, and the authoritative nameservers are harlan.ns.cloudflare.com and lisa.ns.cloudflare.com. Reputation data includes a Gridinsoft trust score of 0/100 and a VirusTotal detection ratio of 3/95 security vendors. The domain is currently listed on one public blocklist and has been blocked by MetaMask, PhishDestroy, and SEAL. While the page content has not been publicly dissected, the combination of a brand‑impersonation label, high‑risk rating, and observed infrastructure suggests a deliberate attempt to lure victims. Defenders should add v1-eig.top to URL filtering policies, monitor DNS queries for the associated IP address, and consider sharing the indicator with threat‑intelligence feeds. Ongoing surveillance is advised to detect any changes in hosting or payload delivery.