1inch[.]airdropsalert[.]icu

Analysis indicates that the domain 1inch.airdropsalert.icu was registered with Dynadot LLC on 17 October 2025. The domain resolves to IP address 142.250.80.100, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating use of Cloudflare DNS services. No TLS certificate was observed, meaning the site served only HTTP. The page title returned by the web server is “Google”, which does not align with the advertised 1inch airdrop. The domain is associated with a fake airdrop campaign targeting users of the decentralized exchange 1inch, as indicated by the brand target field and the scam type “Fake Airdrop”.

VirusTotal has recorded 13 detections out of 95 scanned security vendors, reinforcing the malicious classification. Google Safe Browsing categorizes the URL as a social engineering threat, and the domain appears on one public security blocklist. PhishDestroy has taken the domain offline. ScamAdviser assigns a trust score of 1/100, reflecting a high likelihood of abuse. The site’s current HTTP status is offline, indicating that the operators have removed the content, but the infrastructure artifacts remain observable.

Defenders should continue to block any resolution of 1inch.airdropsalert.icu at the network perimeter and update intrusion‑detection signatures to include the observed IP address 142.250.80.100 and the Cloudflare nameservers. Email gateways should flag messages that reference the domain or contain “1inch airdrop” language, because the campaign likely used phishing emails to lure victims. Continuous monitoring of the registrar Dynadot for future registrations that mimic the 1inch brand is recommended, as well as periodic re‑scans of the domain should it become active again.