app-1linch[.]eu[.]com

The domain app-1linch.eu.com is a confirmed phishing site engaged in brand impersonation targeting 1inch, a cryptocurrency platform. It was designed to deceive users into believing they were interacting with the legitimate 1inch service, posing an elevated risk of cryptocurrency scams. No drainer kit was identified, but the site has since been taken offline.

Technical indicators confirm the malicious nature of app-1linch.eu.com. As of analysis, 1 of 95 VirusTotal security vendors flagged the domain, including Gridinsoft, which assigned a trust score of 0/100. The domain appears on 1 security blocklist (PhishDestroy) but is not flagged by Google Safe Browsing. Registered through Instra Corporation Pty Ltd. on February 21, 2026, it resolved to the IPv6 address 2606:4700:3030::6815:2001, hosted on Cloudflare’s network (AS13335) in the US. The SSL certificate was issued by WE1, and the observed page title was '1inch Chemistry - Advanced Chemical Solutions'. MX records point to eu-com-wildcard-null-mx.centralnic.net, with nameservers under CentralNic.

Users who interacted with app-1linch.eu.com should immediately revoke any token approvals granted to unknown contracts and transfer funds to a new wallet. If credentials were entered, change passwords on the legitimate 1inch platform and enable two-factor authentication. Report the domain to platforms like Google Safe Browsing, PhishTank, or the impersonated brand’s security team to aid in takedown efforts.