dappconnect[.]coinmerges[.]live

Analysis of dappconnect.coinmerges.live, observed as offline at the time of assessment on July 24, 2026, indicates a high‑risk brand‑impersonation campaign targeting users of the 1inch decentralized exchange. The site was registered through the RIPE NCC registry and resolves to the IPv4 address 94.103.183.9, which is allocated to AS212913 (FOP Hornostay Mykhaylo Ivanovych) in Russia. No SSL certificate was presented, and the HTTP service returned no response, confirming the offline status.

The domain is listed on two independent phishing blocklists, specifically PhishDestroy and ScamSniffer, and a Gridinsoft trust score of 0 out of 100 further underscores its malicious reputation. VirusTotal scans show that 14 of 95 antivirus and URL‑reputation engines flagged the domain, reinforcing the suspicion of malicious activity. The sole nameserver associated with the domain is not disclosed, but the presence of a single authoritative server is consistent with rapid‑deployment phishing infrastructure.

The page title “Connect Wallet” aligns with the reported scam type of wallet/seed phishing, suggesting an attempt to harvest private keys or seed phrases from unsuspecting 1inch users. Defenders should block the domain and its hosting IP at perimeter and DNS layers, monitor for any resurgence of the site, and update threat‑intel feeds with the observed indicators. Additional investigation is limited by the lack of live content; analysts should treat any future content as unverified until further technical analysis is performed.