capybaranational-airdrop[.]live

The domain capybaranational-airdrop.live is identified as a brand impersonation threat targeting Revolut users through a fraudulent airdrop campaign. Analysis confirms this domain operates as a phishing site designed to harvest credentials under the pretense of a cryptocurrency token distribution event. The page title, 'Capybara Nation Airdrop,' directly misleads victims into believing they are interacting with an official Revolut promotion. Infrastructure analysis reveals the domain was flagged by 3 of 95 security vendors on VirusTotal, indicating low but detectable malicious activity. It is registered through Web Commerce Communications Limited and resolves to the IP address 188.114.97.3. The domain appears on one security blocklist, further confirming its suspicious nature. No creation date is available, but the combination of technical indicators—including the registrar, IP association, and detection ratio—supports its classification as a high-risk impersonation attempt. At present, capybaranational-airdrop.live has been taken offline, likely due to enforcement actions or hosting provider intervention. However, users who engaged with the site prior to its removal may remain at risk of credential compromise or follow-up phishing attempts. Organizations and individuals are advised to monitor for unauthorized access attempts, revoke any exposed credentials, and implement multi-factor authentication as a mitigation measure. Security teams should also review logs for connections to 188.114.97.3 and block the domain across network defenses to prevent future exposure.