v3-protocol[.]it[.]com

Analysis of the domain v3-protocol.it.com indicates a high‑confidence impersonation of the cryptocurrency aggregator 1inch. The domain was registered on 21 February 2026 and resolves to the IP address 188.114.96.3, which is owned by Cloudflare, Inc. (AS13335) and geolocated in the United States. The TLS certificate presented (identified as “WE1”) is valid for the host and was observed during the scan.

A passive HTTP request returned the page title “Aave – Open Source Liquidity Protocol,” a mismatch that suggests the site is being used to host unrelated content while leveraging the 1inch brand for malicious purposes. The site is classified as a crypto‑scam and is currently offline, but it has been indexed by multiple blocklists; PhishDestroy and ScamSniffer have already added it, and two additional security blocklists reference the domain. VirusTotal analysis shows that three of ninety‑three scanning engines flagged the host, and the Gridinsoft trust score is 0 / 100, reinforcing the malicious assessment.

While the exact payload or credential‑collection mechanism has not been publicly captured, the combination of brand impersonation, cloud‑fronted hosting, and low trust scores provides sufficient evidence for defensive teams to block the domain at network perimeters, update URL filtering feeds, and monitor for any future resurrection. Continued observation of the IP address and associated Cloudflare edge nodes is recommended, as the infrastructure could be repurposed for other phishing or drainer campaigns.