crypto-payd[.]com

This domain represents a high-risk threat, specifically a brand impersonation attack targeting the 1inch decentralized exchange platform. Crypto-payd.com is actively hosting a fake crypto exchange interface designed to trick users into connecting their wallets, likely leading to asset theft via a crypto drainer. The risk level is elevated due to the domain's active status and its deceptive similarity to legitimate 1inch services.

Technical indicators paint a clear picture of malicious intent. VirusTotal data shows 5 out of 95 security vendors flagging this domain, a relatively low detection rate that underscores the need for manual verification. The domain resolves to IP address 151.243.101.224, a location not typically associated with legitimate exchange infrastructure. It was registered through Ultahost, Inc., a registrar often abused for phishing domains, and created on October 29, 2025, giving it a very recent origin. The domain appears on four security blocklists and uses an SSL certificate from Google Trust Services (WE1), a minimal credential that provides only basic encryption, not trustworthiness. The page title 'CRYPTO PAY - Crypto Exchange Platform' further emphasizes the impersonation of a financial service.

To mitigate exposure, users should never visit crypto-payd.com or interact with any pop-ups or connection requests from this site. If you have already connected your wallet, immediately revoke all token approvals using a trusted tool like Revoke.cash, transfer funds to a new wallet, and monitor for unauthorized transactions. Always verify official 1inch URLs through the project's verified social media channels or the PhishDestroy database. For any suspicion of compromise, change passwords and enable two-factor authentication on all associated accounts.