refuel[.]eu[.]com

Analysis of the domain refuel.eu.com, registered on February 21, 2026, indicates a confirmed brand impersonation targeting Revolut, a known financial services provider. The domain is currently offline, but infrastructure evidence reveals multiple indicators of malicious intent. It resolved to IP address 172.67.193.123, hosted on Cloudflare's network (AS13335) in the United States. Nameservers point to CentralNic (ns1.centralnic.net through ns4.centralnic.net), a common provider for both legitimate and malicious domains, while the registrar is Instra Corporation Pty Ltd. The domain's MX records show a wildcard null configuration (eu-com-wildcard-null-mx.centralnic.net), a pattern often used to avoid email-based detection or to mask operational infrastructure. Gridinsoft assigns a trust score of 0/100, reflecting high-risk classification.

Three of 93 security vendors on VirusTotal flagged the domain as malicious, though this does not constitute a full consensus. The domain appears on one security blocklist, and PhishDestroy has blocked it, further supporting the elevated risk assessment. The page title, 'Stratosphere Gas Zip - Bridging the Future of Aerospace Energy,' does not align with financial services or the Revolut brand, suggesting either obfuscation or a placeholder used during domain staging. The SSL certificate (E5) is valid but does not mitigate the domain's fraudulent purpose.

While the exact content of the site remains unanalyzed, the combination of infrastructure, detection flags, and brand impersonation classification confirms its role in a phishing operation. Defenders should treat this domain as compromised and maintain blocklist entries. Organizations should monitor for related domains using the same registrar, nameserver, or hosting patterns, particularly those leveraging Cloudflare or CentralNic infrastructure. If internal logs show user interaction with refuel.eu.