exchangeblock[.]org

Analysis of exchangeblock.org indicates a wallet seed phishing campaign targeting users of the 1inch decentralized exchange platform. The domain was registered on February 21, 2026, through NameCheap, Inc., and resolved to the IP address 67.223.118.114, hosted on AS22612 (Namecheap, Inc.) in the United States. At the time of assessment, the domain is offline, though it previously displayed the page title 'RPC Browser - Loading...', suggesting an attempt to mimic a legitimate RPC or wallet interface. Infrastructure analysis reveals the domain was flagged by four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura.

Detection engines on VirusTotal identified the domain as malicious, with 6 out of 93 security vendors marking it as a threat. Trust scores from Scamadviser (41/100) and Gridinsoft (0/100) further support the classification of this domain as high-risk. The domain lacks an SSL certificate, a common red flag in phishing infrastructure. The domain's nameservers (dns1.namecheaphosting.com and dns2.namecheaphosting.com) align with its registrar, NameCheap, Inc., a frequent choice for low-cost domain registrations used in phishing campaigns.

While the exact content of the phishing page remains unanalyzed, the combination of brand impersonation (1inch), wallet seed phishing classification, and detection by multiple security vendors confirms the elevated risk level. Defenders should treat this domain as confirmed malicious and prioritize blocking or monitoring related infrastructure, particularly any attempts to re-host the domain or reuse its IP address. Further investigation into associated wallet addresses or transaction patterns may reveal additional attack vectors linked to this campaign.