register-whalefloki[.]fun

This domain, register-whalefloki.fun, is identified as a brand impersonation threat targeting Revolut users through a fraudulent airdrop scheme. Analysis indicates the domain was designed to mimic legitimate cryptocurrency promotions, luring victims into disclosing sensitive credentials or financial information under the pretense of a token distribution event. The page title, 'WhaleFloki | Airdrop,' reinforces the social engineering tactic by exploiting trust in cryptocurrency-related incentives, a common vector for credential harvesting and unauthorized account access.

Infrastructure analysis reveals the domain was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with low-reputation domains. It resolves to the IP address 172.67.184.117, which has been flagged in multiple threat intelligence feeds. Detection metrics confirm elevated risk: VirusTotal reports 4 out of 95 security vendors marking the domain as malicious, while two independent security blocklists have listed it. Additionally, automated phishing detection systems have preemptively blocked access, further validating its classification as a high-confidence threat.

Users who visited register-whalefloki.fun should immediately revoke any credentials entered on the site, particularly those linked to financial accounts. If payment details or recovery codes were submitted, affected individuals should monitor for unauthorized transactions and enable multi-factor authentication on all associated services. Given the domain’s current offline status, no active compromise is occurring; however, residual risk remains for those who engaged with the fraudulent content. Security teams are advised to add the domain and its resolving IP to internal blocklists to prevent future exposure.