passive-crypto-ch[.]net

This domain, passive-crypto-ch.net, is confirmed to operate as a fraudulent investment platform impersonating Revolut's cryptocurrency services. Analysis indicates the site specifically targets users seeking passive crypto income opportunities, presenting itself as an official Swiss-based Revolut crypto portal under the page title 'Passive Crypto Switzerland — Offizielle Website.' The infrastructure is designed to deceive victims into transferring cryptocurrency or divulging financial credentials under the pretense of legitimate Revolut offerings, exploiting the brand's reputation in digital banking and crypto services. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain was registered on October 21, 2025, through Dynadot LLC, with no SSL certificate implemented, exposing user interactions to interception. It resolves to IP address 82.221.130.74, hosted in Iceland under AS50613 (Advania Island ehf). Security vendor detection on VirusTotal shows 14 out of 95 engines flagging the domain as malicious. Additionally, the domain appears on one security blocklist and is actively blocked by at least one anti-phishing system. Users who visited passive-crypto-ch.net should immediately revoke any credentials entered on the site and monitor financial accounts for unauthorized transactions. Given the domain's focus on cryptocurrency investment fraud, victims should also check connected crypto wallet addresses for suspicious outgoing transfers. Security teams should update blocklists with the domain and IP address 82.221.130.74, while organizations should alert employees to the specific threat vector of fake Revolut crypto investment portals. The domain's current offline status does not eliminate risk, as threat actors may reactivate similar infrastructure under new domains.