1inch[.]airdropsalert[.]app

This domain, 1inch.airdropsalert.app, poses a high-risk threat as a brand impersonation site targeting users of the 1inch decentralized exchange platform. Analysis indicates the domain was designed to mimic legitimate 1inch airdrop campaigns, a common tactic to deceive users into disclosing wallet credentials, private keys, or authorizing malicious smart contracts. The fraudulent site exploits the trust associated with 1inch branding to facilitate unauthorized access to cryptocurrency assets, leading to potential financial loss for victims. Evidence supporting this assessment includes detection by 18 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly flagging the domain as phishing. The domain resolves to the IP address 142.250.186.100, which is geolocated in Germany under AS15169 (Google LLC), though this appears to be a fronting technique rather than direct hosting. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., and currently lacks an SSL certificate, a red flag for malicious activity. The domain appears on one security blocklist and displays a deceptive page title of 'Google,' further indicating an attempt to evade detection or mislead users. Users who visited 1inch.airdropsalert.app should immediately revoke any smart contract approvals or token allowances granted during the interaction. It is critical to audit all connected wallet addresses for unauthorized transactions and transfer assets to a new, secure wallet if compromise is suspected. Additionally, users should monitor for phishing attempts via email or social media, as attackers may follow up with further credential harvesting. If credentials were entered, assume they are compromised and avoid reusing them across other platforms. Organizations should update internal blocklists to include this domain and its associated IP address to prevent future access.