hemitoken[.]com

Analysis of hemitoken.com indicates an active infrastructure used for brand impersonation targeting Revolut customers. The domain was registered on 29 September 2025 through Tucows Domains Inc. and is hosted on an IPv4 address 80.78.26.203 located in Denmark and announced by ASN AS39287 (Materialism s.r.l.). DNS resolution uses three njalla nameservers (1-you.njalla.no, 2-can.njalla.in, 3-get.njalla.fo). An HTTPS service is provided by Let’s Encrypt (R13) and the web server reports Apache on Ubuntu, returning HTTP 200 for the root URL. The page title retrieved is “$Hemi | AIRDROP”, and the site is identified as employing an “Airdrop Scam” phishing kit. A Facebook Pixel script is present, suggesting tracking capabilities. The domain appears on seven external blocklists and has been flagged by three of ninety‑five VirusTotal scanners. Additional defensive feeds, including PhishDestroy, MetaMask, ScamSniffer, SEAL and Polkadot, have also listed the domain as malicious. The observed risk level is high and the status remains active. No direct inspection of the page content has been performed, so the exact lure mechanisms and credential‑collection vectors are not confirmed. Defenders should block DNS resolution and HTTP/S traffic to 80.78.26.203, add hemitoken.com to URL filtering and email security deny lists, and monitor for related indicators such as the njalla nameservers and the Let’s Encrypt certificate fingerprint. Ongoing surveillance is advised to detect any changes in hosting or kit deployment.