1337reports[.]cc

The domain 1337reports.cc was registered on March 03, 2026 through NiceNIC International Group Co., Limited and remains active as of July 12, 2026. It resolves to the IPv4 address 185.158.133.1, which returns HTTP status code 200 and presents a TLS certificate issued by a widely trusted certificate authority. The page title returned by the server is “1337reports.cc — Fighting Phishing, Illegal Activity & Doxxing.”

Threat intelligence flags the domain as a high‑risk generic phishing site. It appears on a single security blocklist and is explicitly blocked by PhishDestroy. The Gridinsoft trust score is 0 out of 100, indicating a complete lack of trust. VirusTotal reports a single malicious detection out of 95 scanning engines. These indicators collectively support the classification of the domain as malicious.

Infrastructure analysis shows the domain uses authoritative nameservers fred.ns and monroe.ns, which are operated by a major content‑delivery network. The resolving IP is allocated to ASN 13335, a large CDN provider, and geolocates to Poland. The use of a CDN‑based IP range is common for fast‑flux or anonymized phishing infrastructure.

While the current evidence confirms malicious intent, the limited number of detections and the presence on only one blocklist leave uncertainty regarding the full scope of the campaign. No public samples of the landing page content have been shared, and the specific phishing kit or victim targeting details remain unknown.

Defenders should prioritize blocking 1337reports.cc at the DNS and proxy layers, incorporate the domain and its IP address into threat‑intel feeds, and monitor for any related sub‑domains that may be provisioned under the same nameservers. Continuous re‑evaluation is advised as additional detections may emerge.