cake[.]eu[.]com

Analysis of cake.eu.com, created on February 21, 2026, shows a domain leveraged for brand impersonation targeting the cryptocurrency service 1inch. The site resolves to the IP address 172.67.212.37, which belongs to AS13335 Cloudflare, Inc. in the United States, a common hosting provider for fast‑flux and anonymized malicious infrastructure. The domain is registered through Instra Corporation Pty Ltd and uses the four nameservers ns1.centralnic.net, ns2.centralnic.net, ns3.centralnic.net, and ns4.centralnic.net, all of which are consistent with the centralnic registrar footprint.

TLS is provided by a certificate identified as WE1, indicating that encrypted HTTPS was offered while the site was active. Content evidence consists of a page title reading "1inch Wallet - Premium Hardware Wallets," directly implicating the 1inch brand and suggesting a crypto‑wallet lure. VirusTotal scanning recorded five positive detections out of ninety‑three security vendors, confirming that multiple engines recognize the domain as malicious.

The domain appears on two independent blocklists, PhishDestroy and ScamSniffer, reinforcing its classification as a malicious resource. Current status is offline, yet the elevated risk rating remains justified given the observed infrastructure, brand impersonation, and vendor detections. Defenders should continue to block the domain and its associated IP, monitor for newly registered domains using the same registrar or nameserver pattern, and incorporate the observed page title and SSL fingerprint into detection rules to reduce exposure to similar crypto‑related impersonation attempts.