buy-flash-usdt[.]com

buy-flash-usdt.com was registered on 2025-02-17 through Hostinger Operations, UAB. The domain resolves to the IPv6 address 2a02:4780:4e:a461:f9cf:bb45:613e:c683, which is announced by AS47583 Hostinger International Limited and geolocated to the United States. No TLS certificate is presented, indicating the site served only HTTP or was taken offline before HTTPS could be provisioned. The page title observed during a brief crawl was "kayakboat.online", which does not match the domain name or the advertised brand. The domain is listed as impersonating the Revolut brand, a classic case of brand impersonation.

Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single security blocklist, where it is also flagged by PhishDestroy. VirusTotal recorded detections from two of ninety‑five scanning engines, confirming that at least a minority of scanners consider the domain malicious. The domain is currently offline, and no active SSL certificate is present, limiting immediate network interaction but preserving the historical indicators for future correlation. Analysis indicates that the infrastructure is typical of low‑cost phishing operations hosted on shared Hostinger resources, as evidenced by the single nameserver configuration and the lack of dedicated security controls. The mismatch between the domain name, the page title, and the targeted brand suggests a possible attempt to lure Revolut users to a credential‑harvesting page, although the exact payload or page content has not been captured.

Uncertainty remains regarding the specific phishing kit used and whether additional sub‑domains or redirects were employed before takedown. Defenders should continue to block the IPv6 address and any future resolutions to the same hoster, monitor for newly registered domains that share the "buy‑flash‑usdt" pattern, and add the domain to internal allow‑list exclusions for safe‑browsing solutions.