v2-drift[.]click

Analysis of v2-drift.click shows a newly registered domain created on 11 June 2026 via Dynadot, LLC. The authoritative name servers are ns1.dyna-ns.net and ns2.dyna-ns.net, and DNS resolution returns the single address 130.12.180.128. The hosting infrastructure has not been publicly associated with a known ASN or geographic location in the supplied data, limiting attribution. Threat intelligence platforms have recorded six detections out of ninety‑one scanned engines on VirusTotal, indicating that a minority of scanners have identified malicious characteristics.

The domain is listed on three independent security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a phishing vector. The elevated risk rating reflects the convergence of recent registration, detection by multiple scanners, and inclusion on reputable blocklists. No public page title, SSL certificate details, or HTTP response information are available, so the exact payload or impersonated brand cannot be confirmed at this time.

Defenders should block DNS resolution to 130.12.180.128, add v2-drift.click to URL filtering and email security policies, and monitor for any related indicators that may appear in network traffic. Continuous re‑evaluation is advised as additional telemetry, such as content analysis or sinkhole data, becomes available.