diagnosticnode[.]co

This domain, diagnosticnode[.]co, poses an elevated risk of brand impersonation targeting users of the 1inch decentralized exchange protocol. Analysis indicates the site was designed to mimic legitimate 1inch interfaces, potentially facilitating fraudulent transactions or credential harvesting under the guise of a synthetic protocol dApp. The page title, 'Home | Dapps Leading Synthetic Protocol,' aligns with common terminology used in decentralized finance (DeFi) platforms, increasing its likelihood of deceiving users familiar with such services. Infrastructure analysis reveals diagnosticnode[.]co was registered on August 25, 2025, through GoDaddy.com, LLC, a widely used registrar. The domain resolves to the IP address 198.12.66.123 and is hosted on a server running Nginx with OpenResty extensions, a configuration often observed in both legitimate and malicious web infrastructure. Detection metrics further substantiate its malicious nature: the domain appears on five security blocklists and is flagged by 2 out of 95 security vendors on VirusTotal. Additional protections include blocking by Polkadot, Codeesura, PhishDestroy, ScamSniffer, and Enkrypt, indicating broad recognition of its deceptive intent. Users who visited diagnosticnode[.]co should immediately revoke any active wallet connections or permissions granted to the site. Transactions initiated through this domain may result in unauthorized asset transfers, particularly if cryptocurrency wallet interactions were attempted. Affected individuals are advised to audit their connected applications and review recent transaction histories for anomalies. If financial losses are suspected, reporting the incident to relevant blockchain analytics platforms and local cybercrime authorities is recommended to mitigate further risk. Monitoring for secondary phishing attempts via associated email or messaging channels is also prudent, as attackers may leverage compromised data for follow-up campaigns.