passiveincome-app-ca[.]org

The domain passiveincome-app-ca.org was identified as a brand impersonation threat specifically targeting Revolut. This site attempted to deceive users by mimicking the Revolut brand to steal credentials or financial information. The page title, "Passive Income App Canada — Official Site," further reinforced the fraudulent narrative designed to lure victims.

Technical indicators reveal a clear picture of this scam. VirusTotal flagged the domain with a score of 3 out of 95 security vendors, indicating some early detection but not widespread recognition. The domain was registered through Dynadot LLC and created on October 21, 2025, making it a very recent threat. It resolved to IP address 82.221.130.74 and used an SSL certificate from Let's Encrypt (R13), a common choice for low-cost phishing operations. The domain appeared on one security blocklist and was not listed on the Google Safe Browsing (GSB) blocklist at the time of analysis.

The domain has been taken offline, reducing immediate risk. However, users who may have interacted with the site should remain vigilant. PhishDestroy recommends monitoring for suspicious account activity and changing passwords if credentials were entered. The remaining risk is low but not zero, as the threat actors may register new domains under similar names.