1inch[.]airdropsalert[.]us

On July 23, 2026, the domain 1inch.airdropsalert.us was observed as an offline phishing infrastructure targeting the cryptocurrency aggregation service 1inch. The site’s HTML title resolves to “Google”, indicating a possible attempt to mislead automated analysis tools. The domain resolves to IP 142.250.188.4, which belongs to AS15169 owned by Google LLC and is located in the United States. The hosting appears to be provided through Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, while the registrar listed is Dynadot LLC. No TLS certificate was presented at the time of capture, meaning the site served only HTTP. The domain was created on 18 October 2025, giving the operators roughly nine months of activity before takedown.

Multiple defensive products have flagged the domain. Google Safe Browsing classified it as social engineering, and a single security blocklist includes it. The Gridinsoft trust score is 0 out of 100, reflecting an extremely low reputation. VirusTotal analysis shows that 13 of 93 scanning engines returned a malicious classification, reinforcing the malicious nature of the site. The phishing kit is identified as a crypto scam, specifically impersonating 1inch to lure victims into providing private keys or transferring funds.

The domain has been taken offline and is currently blocked by the PhishDestroy remediation service. However, the underlying IP address belongs to a large cloud provider, which could be reused for future malicious campaigns. Defenders should continue to monitor the IP 142.250.188.4 and the associated Cloudflare name servers for any re‑appearance of malicious content. Blocking the domain at DNS level, adding it to web‑filter blocklists, and ensuring that users are educated about unsolicited 1inch‑related communications are recommended mitigations.