flr-portal[.]org

This domain, flr-portal.org, is a confirmed brand impersonation targeting the 1inch decentralized exchange platform. Registered on July 3, 2025, through Dynadot LLC, it was taken offline by the report date of July 24, 2026. The domain resolves to IP 102.209.117.25, hosted in South Africa by AS329184 (Host Africa (Pty) Ltd). No SSL certificate was attached, and the page title was simply 'Connect', consistent with wallet/seed phishing lures.

VirusTotal flagged the domain with 16 out of 95 security vendors, and Google Safe Browsing identified it as a social engineering threat. AlienVault OTX recorded the domain in two threat intelligence pulses, and it appeared on five security blocklists. The domain had a single nameserver and a Gridinsoft trust score of 0/100, indicating high risk. Blocking entities include PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura.

Defenders should verify that any users who visited this domain before its takedown have not entered seed phrases or private keys, and monitor for similar domains registered through Dynadot or hosted on the same IP range. The exact phishing kit or page content beyond the title remains unanalyzed, but the combination of low trust scores, vendor detections, and brand targeting confirms a malicious intent. No further investigation into the live site is needed as the domain is offline, but historical DNS and passive DNS data may reveal related infrastructure.