clippycoin[.]lol

The domain clippycoin.lol has been identified as a brand impersonation threat specifically targeting Revolut, the popular financial technology company. This malicious site was found to be hosting a fraudulent 'CLIPPY | Airdrop' page, designed to trick users into believing they are participating in a legitimate cryptocurrency giveaway. The domain's sole purpose appears to be credential theft and crypto wallet draining, leveraging the trusted Revolut brand to lure victims.

Technical analysis reveals that clippycoin.lol was registered on February 21, 2026, through Eranet International Limited, a registrar often associated with high-risk domains. The site resolves to IP address 104.21.73.26 and lacks any SSL certificate, further indicating its malicious intent. VirusTotal data shows that 10 out of 95 security vendors flag this domain as malicious, and it currently appears on two security blocklists. Google Safe Browsing has not yet listed the domain, but given its recent creation and rapid takedown, it may have been active for only a short period.

The domain is now offline, which suggests that either the hosting provider or registrar has taken action in response to reports. However, the risk remains that similar domains may appear under different names or TLDs, as threat actors often rotate infrastructure. Users who may have interacted with clippycoin.lol should immediately change any passwords used on the site and monitor their accounts for unauthorized activity. It is crucial to avoid entering personal or financial information on any site that mimics a known brand without verifying its authenticity through official channels.