1inch[.]airsdropsalerts[.]sbs

This domain, 1inch.airsdropsalerts.sbs, is flagged for brand impersonation targeting users of the 1inch decentralized exchange platform. The site mimics legitimate airdrop campaigns to deceive victims into disclosing wallet credentials, seed phrases, or authorizing malicious smart contracts. Analysis indicates the infrastructure was designed to exploit users expecting 1inch token distributions, a common tactic in cryptocurrency phishing operations. The page title 'Google' suggests an attempt to evade detection by masquerading as a benign service, while the underlying domain structure leverages the 1inch brand name to build false credibility. Infrastructure analysis reveals the domain was registered on November 07, 2025, through Dynadot LLC, with no SSL certificate present. It resolves to the IP address 142.251.32.100, hosted under AS15169 (Google LLC) in the United States. Security vendor detections on VirusTotal show 11 out of 95 engines flagging the domain as malicious, and it appears on one security blocklist. The absence of encryption and the use of a recently registered domain are consistent with phishing infrastructure, where rapid deployment and low-cost hosting are prioritized over security best practices. Users who visited 1inch.airsdropsalerts.sbs should immediately revoke any wallet authorizations granted to unknown contracts, rotate credentials for all cryptocurrency-related accounts, and monitor for unauthorized transactions. If sensitive information was entered, affected parties should assume compromise and take steps to secure associated assets, including transferring funds to a new wallet. Browser-based security tools or network-level blocking can help prevent future interactions with this domain. Organizations should update internal blocklists to include this domain and its resolving IP to mitigate further exposure.