niftex[.]net

Analysis of the domain niftex.net, created on 21 February 2026, indicates a brand‑impersonation campaign targeting Revolut. The site is currently offline, and its sole observed HTTP response points to a single IPv4 address, 35.220.242.188, which belongs to Google LLC (ASN 396982) and is geolocated in Hong Kong. The TLS certificate presented for the host carries an R10 rating, confirming that a valid SSL certificate was in place at the time of capture.

The page title returned by the server was "HNFT," which does not contain any reference to Revolut and suggests the presence of unrelated or obfuscated content. VirusTotal scans show that two of ninety‑three security vendors flagged the domain as malicious, providing limited but corroborating detection evidence. The domain appears on one public security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the assessment that it was being used for fraudulent activities.

While the offline status prevents real‑time interaction, the infrastructure footprint—including the Google Cloud IP, the recent registration date, and the SSL certificate—remains valuable for threat‑intel correlation. Defenders should continue to monitor the IP address for any future redeployment, ensure that internal web filtering solutions block niftex.net, and propagate the indicator to shared blocklists. Additional observation of DNS changes or re‑activation attempts would help confirm whether the actor is reusing the same hosting environment for subsequent campaigns.