crypto-finance-ch[.]net

This domain, crypto-finance-ch.net, is identified as a brand impersonation phishing site targeting Revolut, a financial services provider. The site was designed to mimic official Revolut communications or portals, likely to deceive users into disclosing sensitive credentials or financial information. As of the latest analysis, the domain is currently offline, though prior activity suggests it was operational long enough to pose a significant risk to unsuspecting users. Analysis of the domain reveals multiple technical indicators of malicious intent. The domain was flagged by 10 of 95 security vendors on VirusTotal, indicating a high likelihood of phishing activity. It was registered through Dynadot LLC on October 21, 2025, and resolves to the IP address 82.221.130.74, located in Iceland under AS50613 (Advania Island ehf). The domain lacks an SSL certificate, a common red flag for phishing sites, and was listed on one security blocklist. The page title, 'Crypto Finance Switzerland — Offizielle Website,' further suggests an attempt to impersonate a legitimate financial entity, though it does not align with Revolut’s branding, potentially indicating a broader or less sophisticated impersonation campaign. The current offline status of crypto-finance-ch.net reduces immediate risk, but the domain’s infrastructure and historical activity warrant continued monitoring. Organizations and users are advised to block the domain and its associated IP address (82.221.130.74) at the network level to prevent potential re-emergence. Security teams should review logs for any prior connections to the domain or IP and conduct user awareness training to highlight the risks of brand impersonation phishing, particularly those targeting financial services. If the domain reactivates, immediate reporting to relevant security platforms and registrars is recommended to facilitate takedown efforts.