1nchs[.]shop

This domain, 1nchs.shop, is flagged as part of a crypto credential theft operation targeting wallet authentication mechanisms. Analysis indicates no direct brand impersonation, but the infrastructure aligns with wallet-drainer kits designed to harvest private keys or seed phrases. The domain exhibits characteristics consistent with phishing pages that mimic decentralized application (dApp) login portals, though no specific kit name has been attributed at this time. Infrastructure analysis reveals the domain was registered on December 29, 2025, through Spaceship, Inc., and resolves to the IP address 8.223.18.18. VirusTotal reports 5 out of 95 security vendors flagging the domain as malicious. It appears on three security blocklists and was included in one threat intelligence pulse on AlienVault OTX. The domain currently returns a 404 Not Found page, suggesting either takedown or temporary deactivation. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification. The domain has been taken offline, reducing immediate risk to users. However, historical resolution data and blocklist persistence indicate prior malicious activity. Organizations should ensure endpoint protection systems block both the domain and its associated IP (8.223.18.18) to prevent residual exposure. Users who interacted with the domain prior to takedown should revoke any connected wallet permissions and monitor for unauthorized transactions. Continuous monitoring of related infrastructure is recommended due to the transient nature of such threats.