so-inv[.]com

This domain, so-inv.com, is a confirmed brand impersonation threat targeting users of the 1inch cryptocurrency platform. Analysis indicates the site was designed to mimic a legitimate trading and investment interface, likely to harvest login credentials, private keys, or other sensitive financial data from unsuspecting victims. The page title, "SO INV | Cryptocurrency trading and invest platform," directly aligns with the branding of 1inch, a well-known decentralized exchange aggregator, increasing the likelihood of successful deception among users familiar with the platform. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on July 18, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.222.67, hosted on Cloudflare’s network (AS13335), a common tactic to obscure the true origin of phishing infrastructure. Security vendors on VirusTotal flagged the domain as malicious, with 12 out of 95 engines detecting it as a threat. Additionally, the domain appears on one security blocklist and uses a low-reputation SSL certificate (WE1), further reducing its legitimacy. If you visited so-inv.com or interacted with its content, immediate action is required to mitigate potential risks. First, revoke any active sessions or permissions granted to the site in your cryptocurrency wallet or browser extensions. Scan your device for malware using updated security tools to detect any secondary payloads. Change passwords for all cryptocurrency-related accounts, particularly those associated with 1inch or other decentralized finance platforms, and enable multi-factor authentication where available. Monitor your wallet addresses for unauthorized transactions and report any suspicious activity to your wallet provider or exchange. Avoid clicking on links from unsolicited messages or emails, even if they appear to originate from trusted sources.