avicimkt[.]world

This domain is flagged as an elevated-risk brand impersonation threat specifically designed to deceive users through a fraudulent airdrop scheme. The infrastructure mimics Revolut, a financial services provider, to exploit trust and likely harvest credentials or cryptocurrency wallet details under the guise of a promotional giveaway. Analysis indicates this is not a generic phishing attempt but a targeted scam leveraging the popularity of airdrop campaigns in the cryptocurrency space. Infrastructure analysis reveals the following technical indicators: the domain avicimkt.world resolves to IP address 188.114.97.3 and was registered on December 15, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com. Security vendor detection on VirusTotal stands at 8 out of 95, while Gridinsoft assigns a trust score of 0 out of 100. The domain appears on one security blocklist and is currently blocked by PhishDestroy. The page title, 'Avici | Airdrop,' further corroborates the scam’s focus on luring victims with false cryptocurrency rewards. Mitigation steps for this specific threat type include immediate domain blacklisting in enterprise security gateways and endpoint protection systems. Organizations should prioritize user education on recognizing airdrop scams, particularly those impersonating financial brands, and emphasize the risks of connecting wallets or entering credentials on unverified platforms. Network administrators are advised to monitor for connections to 188.114.97.3 and implement DNS-based blocking for avicimkt.world. Users who may have interacted with the domain should revoke any connected wallet permissions, reset credentials for associated financial accounts, and scan devices for potential malware exposure.