1inch[.]portal-drops[.]icu

The domain 1inch.portal-drops.icu was registered on October 20, 2025 through Dynadot LLC and is currently taken offline. DNS resolution points to the IP address 172.217.165.132, which belongs to AS15169 Google LLC and is geolocated in the United States. The authoritative name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com indicate that the domain leveraged Cloudflare’s DNS infrastructure, a common choice for malicious operators seeking rapid deployment and resilience. No TLS certificate was observed for the domain, meaning HTTPS was not available at the time of analysis.

The public‑facing page returned a title of “Google,” providing no direct reference to the targeted brand, yet the intelligence label classifies the activity as a crypto‑related scam impersonating the decentralized exchange aggregator 1inch. VirusTotal scans recorded two detections out of ninety‑five vendors, confirming that at least a subset of security products flagged the domain as malicious. The domain appears on one external security blocklist and was actively blocked by the PhishDestroy service, reinforcing the view that it was part of a broader phishing campaign.

While the exact content served by the site has not been captured, the combination of a brand‑targeted identifier in the sub‑domain, the crypto scam classification, and the limited vendor detections suggest a targeted attempt to lure 1inch users into disclosing credentials or sending cryptocurrency. Defenders should continue to monitor for any resurgence of the domain or related sub‑domains, enforce strict URL filtering for *.portal-drops.icu, and consider adding the host to internal blocklists. Because the site is offline, retrospective analysis of traffic logs may reveal victim interaction patterns, and any observed attempts to resolve the domain should be treated as malicious activity.