ens-network[.]net

This domain, ens-network.net, is a confirmed phishing site designed to impersonate the 1inch decentralized exchange platform by masquerading as the Ethereum Name Service (ENS). The site targets users seeking to interact with 1inch services, tricking them into entering sensitive credentials such as wallet private keys, seed phrases, or login details under the guise of ENS functionality. The domain employs brand impersonation tactics, leveraging the trust associated with both 1inch and ENS to facilitate credential harvesting or unauthorized transactions. Analysis indicates the site was operational until recently taken offline, but its infrastructure remains a potential threat for future redeployment or similar attacks. Infrastructure analysis reveals the domain was registered on March 18, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.96.3 and has been flagged by 8 out of 95 security vendors on VirusTotal, indicating widespread detection as malicious. The domain appears on one security blocklist and has been assigned trust scores of 0/100 by Gridinsoft and 1/100 by Scamadviser, further corroborating its malicious nature. Additionally, the domain was included in one threat intelligence pulse on AlienVault OTX, suggesting it was part of a broader phishing campaign targeting cryptocurrency users. Users who visited ens-network.net or interacted with its content should take immediate action to mitigate potential risks. First, revoke any wallet or smart contract permissions granted to the domain or its associated addresses. Monitor connected accounts for unauthorized transactions and consider transferring assets to a new wallet if compromise is suspected. Reset credentials for any accounts accessed while the site was visited, particularly those linked to cryptocurrency services. Additionally, scan local devices for malware, as phishing sites may deploy malicious payloads or redirect to exploit kits. Report the domain to relevant security teams or blocklist providers to aid in broader threat mitigation efforts.