byonex[.]com

This domain, byonex.com, is actively engaged in brand impersonation targeting the cryptocurrency platform 1inch. Analysis confirms the domain is operational and designed to deceive users into believing it is an official 1inch exchange or affiliated service. The threat type is classified as brand impersonation, with no evidence of credential theft or crypto drainer functionality at this stage, though further monitoring is warranted. Infrastructure analysis reveals the domain was registered on May 11, 2025, through CNOBIN INFORMATION TECHNOLOGY LIMITED. It resolves to the IP address 104.21.35.201, hosted on Cloudflare infrastructure (AS13335). The page title, 'Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | Byonex,' directly mimics legitimate exchange platforms. VirusTotal detection indicates 1 of 95 security vendors flag the domain as malicious. The domain appears on one security blocklist and lacks an SSL certificate, a common red flag for fraudulent sites. No historical trust scores or reputation data are available, consistent with newly registered malicious domains. The domain remains active as of the latest verification. Organizations and users are advised to block access to byonex.com at the network level and update endpoint protection rules to include this indicator. Cryptocurrency platforms, particularly 1inch, should issue warnings to their user base regarding this impersonation attempt. Security teams are encouraged to monitor for additional domains registered under the same registrar or resolving to the same IP range, as threat actors often deploy multiple domains in campaigns. Users who may have interacted with the site should verify their wallet security and report any unauthorized transactions.