samaracoin[.]lol

Analysis of the domain samaracoin.lol indicates it was a crypto airdrop scam impersonating Revolut, active until recently taken offline. The domain was registered on February 21, 2026, and resolved to IP address 104.21.30.98, hosted on Cloudflare's network (AS13335) in the United States. The SSL certificate was issued by WE1, a common provider for low-trust domains. At the time of detection, the page title displayed 'SAMARA | Airdrop', suggesting a fraudulent giveaway targeting cryptocurrency users. Gridinsoft assigned a trust score of 0/100, reflecting high confidence in malicious classification.

The domain appeared on four security blocklists and was flagged by PhishDestroy, MetaMask, ScamSniffer, and SEAL. AlienVault OTX included it in one threat intelligence pulse, confirming its use in active campaigns. VirusTotal reported three detections from security vendors, though the specific signatures were not disclosed. The scam type was classified as a crypto scam, consistent with the airdrop theme in the page title.

No live content is currently accessible, as the domain is offline. Defenders should treat any prior connections to this domain as indicators of compromise (IOCs) and monitor for related infrastructure, particularly Revolut-themed phishing or airdrop scams leveraging Cloudflare hosting. If historical traffic logs exist, review for interactions with 104.21.30.98 or the domain itself. No further details on the phishing kit's functionality or victim targeting are available at this time.