xn--80a6aa[.]xn--mb-gmcr3geafc[.]xn--fhghth-3nfabc3cbdc3lbfekref9ftttat374c064ueaif[.]swap-s1[.]eu[.]com

The domain xn--80a6aa.xn--mb-gmcr3geafc.xn--fhghth-3nfabc3cbdc3lbfekref9ftttat374c064ueaif.swap-s1.eu.com impersonates the brand Revolut and has a high threat score of 70/100. The site is currently down, indicating it has likely been taken down due to its malicious activity. VirusTotal reports that 2 out of 95 security vendors, including alphaMountain.ai and Fortinet, have flagged this domain as malicious, and it is listed on one public blocklist, although it is not flagged by Google Safe Browsing.

Registered with Instra Corporation Pty Ltd. in Australia, the domain was created on February 21, 2026, and first detected on February 26, 2026. The hosting IP address is 188.114.97.3. Given the high threat score and confirmed phishing activity, block this domain at the perimeter and submit a report to the registrar's abuse desk.