1inchh[.]mssg[.]me

Analysis conducted on 22 July 2026 identifies the domain 1inchh.mssg.me as an active component of a crypto‑scam campaign targeting users of the 1inch decentralized exchange. The domain was registered on 21 February 2026 through Key‑Systems GmbH and resolves to the IPv4 address 172.67.75.137, which belongs to AS13335 Cloudflare, Inc. in the United States. Hosting is provided by Cloudflare, as indicated by the presence of Cloudflare nameservers (deb.ns.cloudflare.com, guss.ns.cloudflare.com) and the deployment of Cloudflare‑specific technologies including HSTS, Cloudflare Browser Insights and the Cloudflare reverse‑proxy service. TLS termination is performed by a Let’s Encrypt certificate (E7), confirming the use of public‑trusted encryption. Web‑service probing returned an HTTP 404 status, and the page title reported by the scanner is simply “1inch”.

No additional content was retrieved, and the site is currently marked offline. VirusTotal scans recorded three positive detections out of ninety‑five antivirus engines, and the domain appears on four independent security blocklists. Commercial and community blocklist providers PhishDestroy, MetaMask, ScamSniffer and SEAL have also listed the domain as malicious. The detected technology stack includes Google Tag Manager, Google Analytics and FirstPromoter, indicating the possible use of analytics and affiliate tracking services. Although the exact page payload has not been captured, the combination of brand impersonation, crypto‑scam classification, and the presence of these analytics tools suggests a typical credential‑ harvesting or token‑draining infrastructure aimed at deceiving 1inch users.

Defenders should prioritize the inclusion of 1inchh.mssg.me and its resolving IP 172.67.75.137 in firewall and DNS filtering policies. Continuous monitoring of Cloudflare‑hosted infrastructure for new sub‑domains that reference the 1inch brand is advisable, as threat actors frequently recycle the same hosting environment.