crypto-finance-au[.]org

The domain crypto-finance-au.org is a confirmed phishing site engaged in brand impersonation, specifically targeting Revolut users. It presents itself as an official financial platform under the name 'Crypto Finance Australia' but operates as a credential-harvesting scam rather than a crypto drainer. As of the latest verification, crypto-finance-au.org has been taken offline, though prior activity posed an elevated risk to visitors.

Technical analysis reveals that crypto-finance-au.org was flagged by 3 of 95 security vendors on VirusTotal, including CRDF, Gridinsoft, and SOCRadar, with a Gridinsoft trust score of 0/100. The domain appears on 1 security blocklist (PhishDestroy) and was registered through Dynadot LLC on October 21, 2025. It resolved to the IP address 82.221.130.74, hosted on AS50613 (Advania Island ehf), and used an SSL certificate issued by Let's Encrypt (R13). Detected technologies include Nginx and Google Tag Manager, while nameservers were ns1.dyna-ns.net and ns2.dyna-ns.net. Google Safe Browsing did not flag the domain at the time of assessment.

Individuals who visited crypto-finance-au.org should immediately change any passwords entered on the site, particularly for Revolut or other financial accounts, and enable two-factor authentication (2FA) where available. Monitor accounts for unauthorized transactions and report suspected fraud to Revolut's official support channels. The domain can also be reported to anti-phishing initiatives such as PhishTank or the Anti-Phishing Working Group (APWG) to aid in broader takedown efforts.