onelnch[.]com

The domain onelnch.com is currently active and identified as a crypto drainer phishing site targeting users of the 1inch decentralized exchange platform. Analysis indicates the infrastructure is designed to impersonate legitimate 1inch services, likely to execute unauthorized token transfers or credential harvesting under the guise of offering optimal cryptocurrency exchange rates. The page title, "Oneinch — Обмен крипто токенов по лучшим курсам," directly mimics the branding and language used by 1inch, reinforcing the likelihood of brand impersonation for malicious purposes.

Technical indicators confirm the domain's suspicious nature. Onelnch.com is flagged by 6 of 95 security vendors on VirusTotal, with a registration date of June 08, 2026, suggesting an anomalous future-dated creation that may indicate an attempt to evade detection or scrutiny. The domain is registered through Tucows Domains Inc. and resolves to the IP address 45.142.140.105. It appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and is secured with a Let's Encrypt SSL certificate (YE1). The combination of these factors—low vendor detection but high blocklist prevalence—points to a targeted phishing operation rather than a widely recognized threat.

As of the latest verification, onelnch.com remains active and poses a high risk to users. Individuals who have interacted with this domain are advised to immediately revoke any connected wallet permissions, transfer assets to a secure wallet, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP address. Users are further cautioned against engaging with any unsolicited links or communications claiming to offer cryptocurrency exchange services, particularly those mimicking established platforms. Proactive verification of domain authenticity and SSL certificate details is recommended to mitigate similar threats.