fourleafmedical[.]com

The domain fourleafmedical.com was identified as a phishing site engaged in brand impersonation targeting Revolut users. This site posed an elevated risk by mimicking the Revolut brand to deceive victims into disclosing sensitive information, though no crypto drainer kit was detected. As of the latest verification, fourleafmedical.com has been taken offline, reducing immediate exposure but leaving past victims potentially vulnerable.

Technical analysis revealed that fourleafmedical.com was flagged by 2 of 95 security vendors on VirusTotal, including Gridinsoft and Seclookup, with a Gridinsoft trust score of 0/100. The domain appeared on 1 security blocklist (PhishDestroy) but was not flagged by Google Safe Browsing. Registered through ARIN on February 16, 2022, it resolved to the IP address 207.148.7.125, hosted by AS20473 (The Constant Company, LLC) in the US. The SSL certificate was issued by Let's Encrypt (R13), and the observed page title was 'Halocore | Embracing Innovation with Halocore: Optimizing Business Processes for the Future'. The domain utilized a single nameserver.

Victims of fourleafmedical.com should immediately change any credentials entered on the site, particularly Revolut login details, and enable two-factor authentication (2FA) on all financial accounts. Monitor accounts for unauthorized transactions or signs of fraud. Report the phishing domain to local cybercrime authorities, Revolut’s official fraud team, and platforms like Google Safe Browsing or PhishTank to aid in broader mitigation efforts.