cryptoswap[.]website

The domain cryptoswap.website has been identified as a brand impersonation threat specifically targeting 1inch, a decentralized exchange aggregator. This domain was designed to mimic legitimate 1inch infrastructure, potentially to deceive users into disclosing sensitive information or interacting with malicious smart contracts. As of the latest assessment, the domain has been taken offline, though prior activity suggests it was actively used in phishing operations. Analysis indicates that cryptoswap.website was flagged by 3 of 95 security vendors on VirusTotal, a relatively low detection rate that may reflect evasion techniques or recent deployment. The domain was registered through IONOS SE on June 20, 2025, and resolved to the IP address 162.19.192.36. It appears on four security blocklists, including Polkadot, Codeesura, PhishDestroy, and Enkrypt, further corroborating its malicious classification. Additional technical indicators include a Gridinsoft trust score of 0/100, the use of WordPress, MySQL, PHP, Apache HTTP Server, jQuery Migrate, and jQuery, and an SSL certificate issued by Let's Encrypt. The page title was recorded as 'Home page,' a generic label often employed to avoid immediate suspicion. The current status of cryptoswap.website is offline, though the infrastructure may resurface under a different domain or IP address. Organizations and users are advised to monitor for similar impersonation attempts, particularly those leveraging decentralized finance (DeFi) branding. Network defenders should update blocklists to include this domain and its associated IP, while end-users should verify the authenticity of any 1inch-related communications or interfaces before interacting with them. Given the elevated risk level, caution is warranted when encountering domains with similar naming conventions or technical footprints, especially those registered recently or hosted on shared infrastructure.