Notification and current-status evidence
The sent-report ledger records the first outgoing report at .
The recorded recipient is abuse@key-systems.net.
The latest stored availability evidence still shows the domain reachable; 6 months has elapsed since the first outgoing report.
ICANN RAA §3.18 describes registrar abuse-contact and handling obligations. This section records outgoing timestamps, listed recipients, case identifiers, and later availability. It does not by itself prove receipt, acknowledgement, investigation, remediation, or contractual non-compliance.
1inchh[.]mssg[.]me
“1inch”
1inchh.mssg.me — Non vérifié. Usurpation de l'identité de la marque : 1inch; Type d'arnaque : Crypto Scam. Résumé des preuves: VirusTotal 3/95 (Gridinsoft, Phishing Database, PhishFort); 3 external blocklist matches (MetaMask, ScamSniffer, SEAL); PhishDestroy score 74/100. Bureau d’enregistrement: Key-Systems.
L’analyse détaillée de PhishDestroy AI reste en anglais afin de préserver le relevé forensique original.
Analysis conducted on 22 July 2026 identifies the domain 1inchh.mssg.me as an active component of a crypto‑scam campaign targeting users of the 1inch decentralized exchange. The domain was registered on 21 February 2026 through Key‑Systems GmbH and resolves to the IPv4 address 172.67.75.137, which belongs to AS13335 Cloudflare, Inc. in the United States. Hosting is provided by Cloudflare, as indicated by the presence of Cloudflare nameservers (deb.ns.cloudflare.com, guss.ns.cloudflare.com) and the deployment of Cloudflare‑specific technologies including HSTS, Cloudflare Browser Insights and the Cloudflare reverse‑proxy service. TLS termination is performed by a Let’s Encrypt certificate (E7), confirming the use of public‑trusted encryption. Web‑service probing returned an HTTP 404 status, and the page title reported by the scanner is simply “1inch”.
No additional content was retrieved, and the site is currently marked offline. VirusTotal scans recorded three positive detections out of ninety‑five antivirus engines, and the domain appears on four independent security blocklists. Commercial and community blocklist providers PhishDestroy, MetaMask, ScamSniffer and SEAL have also listed the domain as malicious. The detected technology stack includes Google Tag Manager, Google Analytics and FirstPromoter, indicating the possible use of analytics and affiliate tracking services. Although the exact page payload has not been captured, the combination of brand impersonation, crypto‑scam classification, and the presence of these analytics tools suggests a typical credential‑ harvesting or token‑draining infrastructure aimed at deceiving 1inch users.
Defenders should prioritize the inclusion of 1inchh.mssg.me and its resolving IP 172.67.75.137 in firewall and DNS filtering policies. Continuous monitoring of Cloudflare‑hosted infrastructure for new sub‑domains that reference the 1inch brand is advisable, as threat actors frequently recycle the same hosting environment.
Processus de réponse aux menaces Pipeline
Statut de la liste de blocage publique
Technologies · 6 identified
HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.
www.rfc-editor.org Confiance à 100 %Google Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.
www.google.com Confiance à 100 %Google Analytics is a free web analytics service that tracks and reports website traffic.
google.com Confiance à 100 %FirstPromoter is a software platform that helps businesses to create, manage and track their affiliate marketing programs.
firstpromoter.com Confiance à 100 %Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.
www.cloudflare.com Confiance à 100 %Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
www.cloudflare.com Confiance à 100 %Analyse VirusTotal
Preuves archivées
Données factuelles et rapports externes
PD-20260211-228CEC Recipient: abuse@key-systems.net Ce site vous a-t-il affecté ?
Si vous avez saisi des informations d'identification de compte, des informations personnelles ou de paiement, ou téléchargé un fichier à partir de ce domaine, agissez immédiatement. Vous trouverez ci-dessous des ressources pour vous aider à signaler l'incident et à vous protéger.
Signalez-le à vos autorités locales
Sélectionnez votre pays pour obtenir contacts officiels en matière de cybercriminalité ou créer un projet de plainte →.
Vérifier n'importe quel domaine
Analyse des menaces à l'aide de listes de blocage stockées, de WHOIS, de DNS et de preuves d'analyse publique
Scanner maintenantSignaler une tentative d'hameçonnage
Signalez les domaines suspects à notre base de données des menaces — protégez la communauté
SignalerFlux d'alertes en temps réel
Rapports de phishing récents et changements de disponibilité observés
SurveillerRestez informés, restez en sécurité
Surveillez les menaces en temps réel ou signalez cette alerte si vous pensez qu'il s'agit d'un faux positif