1inchswap[.]us

This domain is flagged as a high-risk brand impersonation threat designed to exploit users of the 1inch decentralized exchange platform. Analysis indicates the infrastructure was specifically crafted to mimic legitimate 1inch services, likely with the intent to facilitate unauthorized transactions or credential harvesting. The domain exhibits characteristics consistent with crypto-focused social engineering campaigns, where attackers leverage trusted brand identities to manipulate victims into divulging sensitive information or approving malicious blockchain interactions. Infrastructure analysis reveals the domain 1inchswap.us was registered on February 21, 2026, though no active hosting IP has been publicly attributed at this time. Detection metrics confirm widespread recognition of its malicious nature: the domain is flagged by 11 out of 95 security vendors on VirusTotal and appears on five distinct security blocklists. Registrar details remain undisclosed, but the domain's rapid inclusion in multiple threat intelligence feeds suggests a coordinated effort to distribute the impersonation scheme. Trust scores across detection platforms uniformly classify this domain as malicious, with no legitimate use case identified. Mitigation against this brand impersonation threat requires immediate action from both individual users and platform operators. Users who may have interacted with 1inchswap.us should revoke any connected wallet permissions and audit recent blockchain transactions for unauthorized activity. Platform administrators are advised to proactively monitor for similar domain registrations (e.g., typosquatting variants) and implement DNS-based blocking for confirmed malicious domains. Given the offline status of this specific domain, continued vigilance is necessary, as threat actors frequently rotate infrastructure to evade detection. Organizations should integrate real-time threat intelligence feeds to identify and neutralize emerging impersonation attempts targeting their user base.