airdrop-babylon[.]live

airdrop-babylon.live is a phishing domain engaged in brand impersonation targeting Revolut users with a cryptocurrency scam. The site posed an elevated risk and has been taken offline to prevent further harm. There is no known drainer kit associated with this domain, but its use of Revolut's brand indicates an attempt to deceive victims into fraudulent activity.

airdrop-babylon.live was flagged by 1 of 95 VirusTotal vendors, including Gridinsoft, and appears on one security blocklist, PhishDestroy. It was registered through Web Commerce Communications Limited and resolves to IP address 104.21.28.118, located in the US under Cloudflare's AS13335. The SSL certificate was issued by Google Trust Services / WE1, and the domain uses Cloudflare technologies with HTTP/3 support. The observed page title was 'Babylon Airdrop - Claim Your Tokens'. Nameservers include heidi.ns.cloudflare.com and kyle.ns.cloudflare.com.

Users who encountered airdrop-babylon.live should ensure they change passwords and enable two-factor authentication on any accounts potentially exposed to this brand impersonation phishing scam. It is important to monitor for unauthorized transactions or suspicious activity, especially involving cryptocurrencies. Suspicious emails or messages referencing this domain should be reported to relevant security teams or anti-phishing organizations. Since the site is taken offline, further direct interaction with the domain should be avoided to maintain safety.