masterb0t[.]xyz

Masterb0t.xyz was observed hosting a fake airdrop campaign that purports to be associated with Revolut. The site’s HTML title reads “MasterBOT | Airdrop”, confirming the thematic focus on an airdrop lure. Registration data shows the domain was created on 21 October 2025 through NiceNIC International Group Co., Limited and is served from Cloudflare’s network (ASN 13335) with the IP address 172.67.221.151 located in the United States. No TLS certificate was provisioned, indicating the site was delivered over plain HTTP before being taken offline.

VirusTotal analysis recorded four detections out of ninety‑five scanners, and the domain appears on a single external blocklist, demonstrating that security vendors have begun to flag the infrastructure. The domain was also added to the PhishDestroy blocklist, suggesting that downstream defenses have already been instructed to drop traffic to the host. The nameservers in use are coleman.ns.cloudflare.com and irma.ns.cloudflare.com, both standard Cloudflare resolvers, which complicates attribution but confirms the use of a reputable CDN for rapid deployment. Current HTTP status is offline, preventing direct verification of page content; the only publicly available artifact is the page title.

Defenders should update URL filtering rules to block masterb0t.xyz and any subdomains, incorporate the IP 172.67.221.151 into network‑level deny lists, and monitor for similar airdrop‑related lures targeting Revolut users. Additional hardening includes educating users about unsolicited airdrop offers and encouraging verification through official Revolut channels. Because the site’s infrastructure relies on Cloudflare, future iterations may appear under different hostnames while retaining the same CDN edge, so threat‑intel feeds should be correlated with the observed registration pattern and the “Airdrop Scam” kit signature to catch re‑hosted copies promptly.