kizunacoin[.]net

Analysis of the domain kizunacoin.net indicates that it was actively used to impersonate the decentralized exchange aggregator 1inch in a cryptocurrency‑draining operation. The site was registered on August 14, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolved to the IP address 172.67.144.25, which belongs to AS13335 Cloudflare, Inc. located in the United States. The SSL certificate presented for the host is identified as WE1, confirming that the site employed a valid TLS layer despite its malicious purpose. The page title returned by the server, "Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | CryptoChange," aligns with the declared scam type of a crypto‑related fraud and does not reference the 1inch brand, suggesting a deliberate mismatch intended to lure victims.

VirusTotal scans recorded six detections out of ninety‑three security vendors, providing independent confirmation of malicious activity. The domain has been listed by PhishDestroy and appears on an additional security blocklist, reinforcing its classification as a high‑confidence threat. Current monitoring shows the site is offline, but the infrastructure components—including the Cloudflare edge node and the registrar—remain active and could be repurposed for future campaigns.

Defenders should continue to block the domain at network perimeter devices, update URL filtering rules, and consider sinkholing the associated IP range to disrupt any residual command‑and‑control traffic. Continuous re‑scanning of the domain is recommended to capture any re‑activation attempts, and threat‑intel feeds should be updated to reflect the confirmed 1inch impersonation. Organizations using 1inch services should alert users to the offline status of kizunacoin.net and advise against any interaction with URLs that reference the CryptoChange title or similar cryptocurrency exchange language.