thewhaleguru[.]lol

The domain thewhaleguru.lol was registered on January 14, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently taken offline. Passive DNS indicates that the domain resolves to the Cloudflare address 172.67.220.131, which is associated with AS13335 in the United States. The site presented a page titled "WHALEGURU | Airdrop" and is linked to an Airdrop Scam kit, classifying the operation as a crypto‑related scam.

SSL analysis shows the certificate labeled WE1, confirming the use of HTTPS despite the domain’s short‑lived presence. Reputation scoring from Gridinsoft assigns a trust value of 0 out of 100, reflecting a highly suspicious profile. On VirusTotal, two of ninety‑three scanning engines flagged the domain, providing independent confirmation of malicious intent.

The domain appears on two external blocklists and has been actively blocked by PhishDestroy and ScamSniffer, reinforcing its classification as a brand‑impersonation threat targeting Revolut users. Defenders should continue to block the domain and any related IPs at the network perimeter, monitor for any residual references in logs, and ensure that endpoint detection rules incorporate the observed SSL fingerprint and the specific page title string. Given the low trust score and the presence on multiple blocklists, the domain should be treated as a confirmed malicious indicator and added to internal threat intel feeds for ongoing protection.