generaldiagnosticrefix[.]co

The domain generaldiagnosticrefix.co was first observed on October 17 2025, registered via Global Domain Group LLC. It resolves to the IPv4 address 198.23.156.130, which is allocated to AS36352 (HostPapa) and geolocated to the United States. The authoritative nameservers are ns1.host-forest.com and ns2.host-forest.com. No TLS certificate is presented; HTTP requests return no SSL handshake, indicating the site operated over plain HTTP before being taken offline. The only visible page title returned by the web server is “Home | Dapps Leading Synthetic Protocol”, a generic phrase that does not reference the targeted brand.

Nevertheless, threat intelligence links the domain to a wallet/seed phishing campaign that impersonates the decentralized exchange aggregator 1inch. VirusTotal analysis recorded 13 positive detections out of 95 submitted scanners, corroborating malicious intent. The domain is listed on five public blocklists—PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura—each of which classifies it as a phishing or scam host. Gridinsoft assigns a trust score of 0 / 100, confirming the extreme risk rating.

The site’s current HTTP status is “offline”, suggesting that the hosting provider or a takedown request has removed the content. Despite the offline state, the infrastructure components—namely the hosting ASN, IP address, and nameserver configuration—remain active and could be reused for future campaigns. Defenders should continue to block the resolved IP and associated host‑forest nameservers at the network perimeter, add the domain to internal blocklists, and monitor for any re‑registration of the same name or reuse of the same hosting resources. Threat‑intel feeds should be updated to reflect the domain’s historical activity and its association with 1inch impersonation, enabling rapid correlation with similar future indicators.