0inch[.]io

This domain, 0inch.io, is actively impersonating the 1inch decentralized exchange platform as of July 12, 2026. Registered on July 4, 2023, the domain resolves to IPv6 address 2a06:98c1:3121::3 and is hosted behind Cloudflare infrastructure, utilizing HTTP/3 and HSTS protocols. The page title 'ur cock' does not align with typical cryptocurrency or financial service branding, suggesting either deliberate obfuscation or an incomplete setup. Analysis indicates the domain is flagged by 5 out of 95 security vendors on VirusTotal and appears in 24 threat intelligence pulses, reinforcing its classification as high-risk brand impersonation. Infrastructure analysis reveals the domain is registered through Cloudflare and uses a Google Trust Services SSL certificate, which may contribute to its perceived legitimacy despite malicious intent. It is currently blocked by at least two security blocklists, including PhishDestroy and BLP-Malware, and holds a trust score of 0/100. The domain remains active, with no evidence of takedown or mitigation efforts as of the latest verification. The exact nature of the threat remains uncertain due to the lack of detailed forensic analysis on the site's content. While the domain is explicitly linked to 1inch impersonation, the anomalous page title raises questions about whether this is a fully operational phishing kit or an intermediary staging environment. Defenders should treat this domain as hostile and prioritize blocking it at the DNS and network levels. Organizations using 1inch or similar DeFi platforms should monitor for user reports of interaction with 0inch.io and conduct retrospective log analysis to identify potential exposure. Given the domain's persistence since 2023, proactive hunting for related indicators of compromise is recommended.