zrealsol[.]lol

This domain, zrealsol.lol, has been identified as engaging in brand impersonation targeting Revolut, a financial services company. The domain was created on February 21, 2026, and is currently offline, which may indicate that it has been taken down by security measures or the operators. The domain uses Cloudflare nameservers (marek.ns.cloudflare.com and romina.ns.cloudflare.com) and resolves to the IP address 172.67.143.123, located in the United States and associated with Cloudflare, Inc. (AS13335). The domain does not have an SSL certificate, which is a common indicator of a lack of legitimate security practices.

The page title found is 'ZREAL | Airdrop,' suggesting a crypto scam operation, which often involves misleading users with promises of free cryptocurrency. This domain is listed on two security blocklists, PhishDestroy and ScamSniffer, indicating a known threat. Additionally, 13 out of 93 security vendors on VirusTotal have flagged this domain as malicious, further supporting its classification as a threat. While the domain is currently offline, defenders should remain vigilant and ensure that it remains blocked to prevent any potential reactivation.

Infrastructure analysis reveals the domain is registered through Eranet International Limited, which may be a point of interest for additional investigation. The exact content and structure of the phishing kit, described as an Airdrop Scam, have not been fully analyzed, but the available evidence strongly suggests a crypto scam operation. Defenders should continue monitoring the domain and update their security policies and user awareness programs accordingly.