1inch[.]beefyhubs[.]cfd

Analysis of the domain 1inch.beefyhubs.cfd shows a confirmed crypto‑scam infrastructure that impersonates the decentralized exchange brand 1inch. The domain was created on 21 October 2025 through Dynadot LLC and resolves to the IPv4 address 216.58.206.68, which is owned by AS15169 Google LLC and geolocated to Germany. Leveraging a Google‑owned IP is a known evasion technique that allows malicious traffic to blend with legitimate services. The site does not present a TLS certificate, indicating it was served over plain HTTP, and the HTTP response returns a page title of “Google”, offering no direct indication of the targeted brand. DNS resolution is handled by the Cloudflare authoritative nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, suggesting the operator used Cloudflare’s DNS service to gain redundancy and hide the true hosting location.

Multiple security data sources corroborate the malicious nature of the domain. It appears on one public blocklist and has been flagged by seven of ninety‑five VirusTotal scanners, reflecting a modest but consistent detection rate across independent vendors. Gridinsoft assigned a trust score of 0 out of 100, and the domain is listed as blocked by the PhishDestroy feed. The current status is offline, and no HTTP status code is observable, but historical evidence is sufficient for remediation.

Given the elevated risk rating, defenders should immediately add 1inch.beefyhubs.cfd to network firewalls, DNS filtering solutions, and endpoint blocklists. Monitoring for new subdomains under the beefyhubs.cfd second‑level domain is advised, as well as inspection of traffic to the IP 216.58.206.68 for anomalous plain‑HTTP requests. Because the nameservers are Cloudflare‑based, alerts on similar resolver configurations can help detect future campaigns that reuse this infrastructure.