bafybeih5pfx5fqa75tfwt72snvtawkh25sdux4ezzaopipq264xqxg5lse[.]ipfs[.]dweb[.]link

This domain, bafybeih5pfx5fqa75tfwt72snvtawkh25sdux4ezzaopipq264xqxg5lse.ipfs.dweb.link, is identified as an elevated-risk brand impersonation threat targeting 1inch, a decentralized finance (DeFi) and decentralized exchange (DEX) aggregator. The domain is currently offline but previously hosted content mimicking the legitimate 1inch platform, specifically replicating its dApp interface for Ethereum, Binance Smart Chain, Optimism, Polygon, and Arbitrum networks. Analysis indicates the domain was flagged by 17 of 95 security vendors on VirusTotal, signaling broad detection of its malicious intent. Infrastructure analysis reveals it was registered through CSC Corporate Domains, Inc., and resolved to the IP address 209.94.90.3, hosted on AS40680 (Protocol Labs) in the United States. The domain was created on February 21, 2026, an anomalous future date suggesting potential manipulation or misconfiguration. It appears on two security blocklists and was previously blocked by PhishDestroy and PhishingDB. The SSL certificate was issued by Let's Encrypt (serial number E7), a common but not inherently suspicious certificate authority often leveraged in malicious campaigns for legitimacy. The domain has since been taken offline, reducing immediate risk to users. However, organizations and individuals are advised to proactively block the domain and its associated IP (209.94.90.3) at the network level to prevent potential re-emergence. Security teams should monitor for similar impersonation attempts targeting DeFi platforms, particularly those using IPFS-based domains or anomalous registration dates. End-users should verify the authenticity of any 1inch-related domains by cross-referencing with official communications from the 1inch project and avoiding interaction with untrusted dApp interfaces.