register-kurumi[.]fun

This domain, register-kurumi.fun, poses a specific threat of brand impersonation, targeting the financial services brand Revolut. The domain is designed to trick users into believing they are interacting with an official Revolut service, potentially leading to the disclosure of sensitive information such as login credentials and personal data.

Analysis indicates that the domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on December 30, 2025. Infrastructure analysis reveals that the domain resolves to the IP address 172.67.173.27. On VirusTotal, 2 out of 95 security vendors flagged this domain, suggesting a low but significant level of risk. The domain appears in 1 threat intelligence pulse on AlienVault OTX and is listed on 2 security blocklists, including ScamSniffer and PhishDestroy. These indicators point to its involvement in phishing activities and the use of an airdrop scam phishing kit.

If users have visited register-kurumi.fun, they should immediately check their Revolut account for any unauthorized activity. It is recommended to change account passwords and enable two-factor authentication (2FA) if not already active. Users should also monitor their financial statements for any unusual transactions and report any suspicious activity to Revolut's customer support. Users are advised to be cautious of unsolicited emails or messages that direct them to unfamiliar websites, even if they appear to be from trusted sources.