join-tbysol[.]xyz

This domain, join-tbysol.xyz, poses as a legitimate Revolut promotional campaign offering a fake airdrop to deceive users into disclosing sensitive financial information or cryptocurrency wallet credentials. The site exploits the growing trend of cryptocurrency giveaways, presenting itself as an official Revolut initiative under the guise of a project named 'TOBY.' Victims are typically lured through social media advertisements or direct messages, where they are prompted to connect wallets or enter personal details to claim non-existent rewards. Such schemes often lead to unauthorized account access, financial theft, or malware installation. Analysis indicates this is a deliberate brand impersonation campaign targeting Revolut users. The domain was registered on December 04, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.97.3 and is currently flagged by 5 out of 95 security vendors on VirusTotal. Additionally, the domain appears on two security blocklists and has been blocked by ScamSniffer and PhishDestroy. The page title, 'TOBY | Airdrop,' further confirms the fraudulent nature of the operation, as legitimate financial institutions do not use unofficial branding for promotional events. If you visited join-tbysol.xyz or interacted with its content, immediate action is required. Disconnect any connected wallets or devices from the site and revoke any permissions granted. Change passwords for Revolut and any linked accounts, enabling multi-factor authentication where available. Monitor financial statements and transaction histories for unauthorized activity, and report any suspicious behavior to your financial institution. Consider scanning affected devices for malware, as phishing sites may deploy malicious scripts. Users should also report the domain to their local cybersecurity authorities to aid in takedown efforts and prevent further victimization.