1inch[.]exchange[.]aqanu[.]org

1inch.exchange.aqanu.org impersonates the cryptocurrency platform 1inch, aiming to deceive users into divulging sensitive information. The domain is flagged by 11 out of 93 VirusTotal vendors, indicating a significant threat level. Public blocklists, including PhishDestroy, MetaMask, SEAL, and Enkrypt, have identified this domain as malicious. Google Safe Browsing also flags it, reinforcing its malicious status.

The domain, though now offline, was hosted on IP 67.215.3.243 in Canada, under GloboTech Communications (ASN: AS36666). The SSL certificate was issued by Let's Encrypt, a common choice for malicious actors due to its free and automated nature. Despite its creation date in 2004, it was first detected by PhishDestroy in November 2025, suggesting it lay dormant before being activated for phishing activities.

Interestingly, the page title, "Latest Pest Control News, Features and Blog Articles from BPCA," is a misleading tactic to obscure its true intent. The site also detected the brand "celer," potentially indicating a broader scope of deception. The registrar, WHC Online Solutions Inc., is often used for quick and anonymous domain registrations, facilitating such scams. The platform's risk score is low at 10/100, possibly due to its short-lived activity.

This case underscores the importance of early detection systems like PhishDestroy's, which capture threats in the critical window before widespread AV database updates. While the domain is currently offline, its initial activity highlights the ongoing risks in the cryptocurrency space, where phishing schemes continue to evolve and exploit unsuspecting users.