bircoinvn[.]io

Analysis of bircoinvn.io shows an active, high‑risk brand‑impersonation campaign targeting the 1inch brand. The domain was registered on November 13, 2025 through NiceNIC International Group Co., Limited and resolves to IP 188.114.96.3, which is hosted in the United States under ASN 13335 (Cloudflare, Inc.). DNS resolution uses the Cloudflare nameservers armando.ns.cloudflare.com and vivienne.ns.cloudflare.com, and the site presents a Google Trust Services / WE1 SSL certificate. HTTP requests return a 302 redirect, and the page title advertises "Instant Bitcoin & Cryptocurrency Exchange in Vietnam - BitcoinVN," indicating a cryptocurrency‑related lure. The domain appears on four public blocklists and is specifically blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. AlienVault OTX references the domain in 23 threat‑intel pulses, and five of ninety‑five VirusTotal scanners have flagged it. While the exact payload or credential‑harvesting mechanisms have not been publicly disclosed, the combination of brand impersonation, redirection behavior, and multiple security vendor detections suggests a deliberate attempt to deceive users. Defenders should immediately block DNS resolution to bircoinvn.io, add the domain to web‑filter deny lists, and monitor outbound connections to the associated IP address. Continuous threat‑intel feeds should be consulted for any emerging indicators of compromise related to this infrastructure, and incident response teams should be prepared to investigate any user reports of suspicious activity involving 1inch‑related URLs.