penguinonsol[.]app

On July 25, 2026, analysis flags penguinonsol.app as an active high‑risk impersonation of Revolut. The domain was registered on 22 February 2026 through NiceNIC International Group Co., Limited and resolves to 104.21.39.72, an IP owned by Cloudflare (AS13335) located in the United States. The site is served behind Cloudflare, employs HTTP/3, and presents a Let’s Encrypt certificate (E8) that is currently valid. An HTTP 301 redirect is observed, and the page title returned by the server is “Nietzschean Penguin | Airdrop”, which aligns with the identified “Airdrop Scam” phishing kit and a wallet/seed phishing payload targeting Revolut users.

VirusTotal scans show three of ninety‑five antivirus engines flagging the domain, while Gridinsoft assigns a trust score of zero out of one hundred, indicating a highly malicious profile. The domain appears on four public blocklists and is already listed by PhishDestroy, MetaMask, ScamSniffer, and SEAL, confirming broad detection across multiple anti‑phishing services. Nameservers kinsley.ns.cloudflare.com and tim.ns.cloudflare.com are consistent with the Cloudflare hosting footprint. The available intelligence does not include a full content scrape; therefore the exact layout, form fields, or credential‑capture mechanisms remain unverified, although the kit designation suggests a typical seed‑capture workflow.

Defenders should immediately block traffic to penguinonsol.app at the network perimeter and DNS resolver level, add the domain to endpoint and email security deny lists, and monitor for any sub‑domains or similarly structured domains created after February 2026 that reference Revolut or airdrop terminology. Continuous re‑scanning with multi‑engine services is advised to capture any evolution of the payload, and analysts should correlate any observed wallet‑seed submissions with known Revolut compromise indicators.