1inch[.]io-webv3-chain-app[.]com

The domain 1inch.io-webv3-chain-app.com was registered on February 21, 2026. It resolves to the IP address 104.21.57.40, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presents a TLS certificate identified as WE1, indicating that HTTPS is offered but does not provide additional validation of the service owner. HTTP requests return a generic “Page Not Found” title, which suggests that the malicious landing page has been removed or disabled. The domain is classified as a brand‑impersonation campaign targeting the cryptocurrency aggregator 1inch, and the underlying scam type is recorded as a crypto scam.

VirusTotal scans have recorded 11 positive detections out of 95 security vendors, confirming that a subset of commercial scanners recognize the host as malicious. The domain is listed on at least one public security blocklist and has been actively blocked by the PhishDestroy mitigation service. Current status is offline, indicating that the operators have taken the site down, either voluntarily or as a result of takedown actions. Evidence gaps remain: no public WHOIS registrar information is provided, and no detailed payload or phishing page content has been captured. Consequently, the exact method used to lure victims cannot be confirmed.

Analysts should continue to monitor the associated IP address for re‑use, as Cloudflare infrastructure is frequently recycled for new malicious domains. Defensive measures should include adding the domain and its IP to block lists, enforcing TLS inspection to detect any future TLS certificates issued for the same FQDN, and updating endpoint and network detection rules to flag any traffic to the domain or to the Cloudflare AS13335 range that matches the known TLS fingerprint. Organizations using the legitimate 1inch service should educate users about the risk of unsolicited links and encourage verification of URLs before any credential entry.