momentum-glow-ai-com[.]cryptofinancetrack[.]com

The domain momentum-glow-ai-com.cryptofinancetrack.com is identified as a brand impersonation threat targeting Revolut, a financial services provider. Analysis confirms the domain was designed to mimic legitimate Revolut properties, likely to deceive users into disclosing sensitive credentials or financial information. As of the latest verification, the domain is offline, though prior activity suggests it may have been operational for malicious purposes. Technical indicators reveal the domain was flagged by 17 of 95 security vendors on VirusTotal, indicating broad detection as malicious. It was registered through MainReg INC on January 30, 2025, and resolves to the IP address 172.67.74.167, hosted on Cloudflare's infrastructure (AS13335). The domain appears on one security blocklist, and no SSL certificate was present during its active period. The page title, "Momentum Glow AI ™ - Die offizielle App-Website 2025 [AKTUALISIERT]," further suggests an attempt to impersonate an official Revolut application or service, using German-language content to target specific user demographics. Current status confirms the domain is offline, reducing immediate risk to users. However, the infrastructure and registration details indicate potential for re-emergence under a similar or altered domain. Organizations and users are advised to block the domain and associated IP address (172.67.74.167) at the network level. Security teams should monitor for newly registered domains with similar naming patterns or registration details, particularly those leveraging Cloudflare hosting. End-users should verify the authenticity of any Revolut-related communications or websites by accessing official channels directly and reporting suspicious domains to relevant security providers.