maxidogetoken[.]netlify[.]app

This domain is flagged as a high-risk brand impersonation site specifically targeting 1inch, a decentralized exchange aggregator. The threat type involves credential harvesting and token theft through fraudulent decentralized finance (DeFi) interfaces, designed to deceive users into connecting wallets or entering recovery phrases under the pretense of legitimate 1inch services. The page title 'Decentralization' reinforces the false appearance of authenticity, increasing the likelihood of successful social engineering attacks against cryptocurrency users. Analysis indicates the domain maxidogetoken.netlify.app remains active and is hosted on Netlify infrastructure. It resolves to the IPv6 address 2a05:d014:58f:6200::259, geolocated in Germany under Amazon.com, Inc. AS16509. The SSL certificate is issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), providing a false sense of security. VirusTotal reports 1 out of 95 security vendors flagging the domain, while it appears on one security blocklist and is specifically blocked by PhishDestroy. The domain structure, leveraging Netlify's subdomain service, suggests rapid deployment and low-cost hosting, typical of phishing campaigns targeting DeFi platforms. Mitigation requires immediate action from network defenders, wallet providers, and end-users. Network-level blocking should be implemented for the domain and its resolving IP address. Wallet software and browser extensions should integrate detection logic for this domain, particularly in transaction signing workflows. Users must verify domain authenticity before connecting wallets or entering sensitive information, cross-referencing official 1inch communication channels for legitimate URLs. Given the high-risk nature of token theft, any interaction with this domain should be treated as a security incident, requiring immediate revocation of connected wallet sessions and monitoring for unauthorized transactions.