get-ens[.]org

The domain get-ens.org is assessed as having an elevated risk level, with the specific threat type identified as brand impersonation. This domain is designed to mimic the legitimate 1inch brand, potentially leading users to divulge sensitive information or perform unauthorized transactions.

Analysis indicates that get-ens.org has been flagged by 15 out of 95 security vendors on VirusTotal, suggesting a moderate level of suspicion in the cybersecurity community. The domain was registered through NiceNIC International Group Co., Limited, and does not have an SSL certificate, which is a common indicator of a non-secure site. The domain resolves to the IP address 104.21.95.172, which is located in the United States and is associated with AS13335 Cloudflare, Inc. The domain was created on June 06, 2024, and appears on two security blocklists, including PhishDestroy and Enkrypt. These data points collectively suggest that the domain was likely used to impersonate the Ethereum Name Service (ENS) to deceive users into believing it was related to the 1inch brand.

To mitigate the risks associated with brand impersonation, users are advised to verify the URL of any website they are interacting with, especially those purporting to offer services related to the 1inch brand. It is crucial to ensure that the URL matches the official 1inch domain and that the site has a valid SSL certificate. Additionally, users should be cautious of unsolicited communications and links, and report any suspicious activity to the official 1inch support channels. Network administrators and security teams should consider blocking access to this domain and similar suspicious sites to prevent potential phishing attacks.