sell-yourtickets[.]com

This domain is flagged as a high-risk brand impersonation site specifically targeting Revolut, a financial services platform. Analysis indicates the site is designed to deceive users into disclosing sensitive account credentials or authorizing fraudulent transactions under the guise of legitimate Revolut communications. The threat type is classified as brand impersonation with potential secondary objectives, such as credential theft or unauthorized fund transfers, based on the observed infrastructure and historical patterns associated with similar campaigns. Infrastructure analysis reveals the domain sell-yourtickets.com was registered on May 12, 2025, through GMO Internet, Inc. It resolves to the IP address 172.67.129.69, located within the United States and associated with AS13335 (Cloudflare, Inc.). The SSL certificate is issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority - G2. Detection metrics show 13 out of 95 security vendors on VirusTotal flagged the domain as malicious, while Google Safe Browsing explicitly categorizes it as phishing. The domain appears on two security blocklists, including PhishDestroy and ScamSniffer. The page title, 'Pudgy Penguins,' suggests an attempt to mislead users by leveraging unrelated branding, a tactic often employed to evade automated detection systems. Mitigation steps for this threat type include immediate reporting to the impersonated brand’s security team to facilitate takedown procedures. Network administrators should block the domain and associated IP address (172.67.129.69) at the perimeter level to prevent access. End-users who may have interacted with the site should be instructed to reset their credentials using multi-factor authentication and monitor their accounts for unauthorized activity. Organizations should also review logs for connections to the domain or IP to identify potential compromise. Given the domain’s current offline status, continuous monitoring for reactivation or similar domains registered through the same registrar is recommended.