worldcoin[.]worldprofit[.]vip

The domain worldcoin.worldprofit.vip, which impersonates the financial brand Revolut, has been flagged by 8 out of 95 vendors on VirusTotal as malicious. This domain was part of an investment scam that promised digital rewards through a so-called "Unlimited Advertising System." Despite its takedown, the domain was initially detected by PhishDestroy on October 28, 2025, indicating its recent activity before being shut down.

Registered through NameCheap, Inc. and hosted on an IP address in Poland under Cloudflare's ASN, the domain lacked SSL certification, which is often a red flag for phishing operations. The site claimed to offer digital rewards, a common lure in investment scams, to exploit users' trust in the Revolut brand. The platform risk score was notably low at 10/100, while the abuse score was 34/100, reflecting its malicious intent.

The domain's presence on one public blocklist, specifically PhishDestroy's, underscores the effectiveness of early detection systems in identifying threats before they become widespread. Phishing domains like this one often exploit the delay between domain registration and antivirus database updates, highlighting the importance of upstream threat intelligence solutions. Despite its offline status, the domain's activity serves as a reminder of the ongoing threat posed by phishing scams targeting well-known financial brands.