register-mobpsycho[.]fun

This domain, register-mobpsycho.fun, is flagged as a brand impersonation threat targeting Revolut users. Analysis indicates the site mimics the Revolut brand to promote a fake airdrop, as evidenced by the page title 'Mob Psycho | Airdrop.' Such infrastructure is commonly associated with credential harvesting or cryptocurrency drainer kits, though no specific kit has been confirmed in this instance. The domain’s intent appears to be the extraction of sensitive user data under the guise of a legitimate promotion. Infrastructure analysis reveals several technical indicators of compromise. The domain is registered through NiceNIC International Group Co., Limited and was created on February 21, 2026, suggesting a recent and potentially short-lived operation. It resolves to the IP address 104.21.50.112 and employs Cloudflare for content delivery and DDoS protection, a common tactic to obscure hosting origins. Security vendors on VirusTotal flag the domain at a rate of 6/95, while it appears on one security blocklist. The SSL certificate is issued by Google Trust Services, and the site supports HSTS and HTTP/3, which may lend an appearance of legitimacy despite its fraudulent purpose. The domain remains active and poses an elevated risk to users. Immediate response actions should include blocking access to the domain and its associated IP address within network security controls. Users who interacted with the site should be advised to reset credentials and monitor accounts for unauthorized activity. While the domain is currently flagged by security mechanisms, its continued operation underscores the need for vigilance, particularly among Revolut customers who may be targeted by similar campaigns. The use of Cloudflare and a reputable SSL issuer complicates takedown efforts, prolonging the potential threat window.