buymeo[.]org

The domain buymeo.org was registered on May 20, 2025 through NiceNIC International Group Co., Limited. It is listed as a brand‑impersonation campaign targeting the decentralized exchange aggregator 1inch. DNS resolution points to the IP address 104.21.3.73, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. No TLS certificate is presented, indicating the site operates without HTTPS protection.

The public page title retrieved from the site reads “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | YukiTale,” suggesting a cryptocurrency‑exchange façade rather than a legitimate 1inch interface. The domain received a Gridinsoft trust score of 0 / 100, reflecting a lack of credibility in that vendor’s assessment. VirusTotal reports a single positive detection out of 95 submitted security scanners, and the domain appears on one external security blocklist. PhishDestroy has taken the domain offline, and its current HTTP status is reported as taken offline.

The evidence confirms that the infrastructure was used to lure victims under the guise of a trusted brand and to present a crypto‑exchange narrative, consistent with a crypto‑scam pattern. Uncertainty remains regarding the exact phishing payload or credential‑capture mechanisms because the site content has not been captured in detail. Defenders should continue to block the resolved IP address and any associated Cloudflare edge nodes, enforce domain‑level filtering for buymeo.org, and monitor for newly registered domains that resolve to the same Cloudflare ASN or that exhibit similar page‑title keywords. Ongoing threat‑intel feeds should be consulted for any re‑appearance of the domain or related indicators, and incident‑response teams should be alerted if users report exposure to the 1inch brand‑impersonation attempt.