protocolspheredapp[.]pages[.]dev

PhishDestroy identifies protocolspheredapp.pages.dev as a high-risk brand impersonation threat specifically targeting the 1inch decentralized finance platform. This domain was designed to deceive users by mimicking a legitimate 1inch service, potentially to steal credentials, private keys, or funds. The site's page title, 'FaucetNodes,' is unrelated to 1inch but typical of fraudulent faucet or node services used to lure victims.

Crucially, VirusTotal flagged this domain with 10 out of 95 security vendors marking it as malicious, and it appears on three security blocklists. The domain was created on February 26, 2025, and registered through Cloudflare, Inc., resolving to IPv6 address 2a06:98c1:3120::3. Its SSL certificate was issued by Google Trust Services (WE1), which is legitimate but commonly abused by phishing sites. Despite being taken offline, the domain historically posed a serious threat to 1inch users.

Users who may have visited protocolspheredapp.pages.dev should immediately change passwords for any accounts used on the site, enable two-factor authentication on all cryptocurrency wallets and exchange accounts, and monitor for unauthorized transactions. It is critical to verify any communications claiming to be from 1inch by visiting the official website directly. PhishDestroy strongly recommends avoiding interaction with this domain and reporting any similar suspicious domains to relevant authorities.