1inch[.]app-airdropalert[.]lat

This domain 1inch.app-airdropalert.lat was observed to resolve to IP 142.250.181.228, which is allocated to AS15169 Google LLC in the United States. The domain was registered on November 10, 2025 through Dynadot LLC and is served by Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate was presented during connection attempts, indicating the site operated without HTTPS protection. The page title returned by the HTTP response is “Google”, which does not correspond to the advertised brand.

The domain explicitly targets the cryptocurrency aggregator 1inch, as indicated by the brand target field, and is classified as a crypto‑scam. Reputation services assign extremely low trust scores: Scamadviser rates the site 1 / 100 and Gridinsoft 0 / 100. The domain appears on a single security blocklist and has been blocked by PhishDestroy. VirusTotal reports that 12 of 95 scanning engines flagged the domain as malicious, reinforcing the suspicion of malicious intent.

The site is currently offline, preventing immediate interaction, but the infrastructure artifacts remain useful for detection and attribution. Defenders should add the fully qualified domain name and its associated IP address to outbound filtering rules, monitor for any future DNS resolution to the same IP or Cloudflare name servers, and incorporate the observed trust‑score thresholds into automated triage. Because the site lacks an SSL certificate and presents a generic page title, any future re‑appearance should be treated as high priority for investigation. At present, the lack of additional payload or command‑and‑control indicators means the precise malicious behavior is uncertain, but the compiled evidence warrants elevated mitigation.