timefarmairdrop[.]live

The domain timefarmairdrop.live was a phishing site engaged in brand impersonation targeting Revolut users as part of a cryptocurrency scam. It posed as a legitimate airdrop campaign under the name 'Time Farm Airdrop' to deceive victims into disclosing sensitive information or transferring digital assets. No drainer kit was identified, but the site operated as a credential and crypto-focused phishing page. As of the latest verification, timefarmairdrop.live has been taken offline.

Technical indicators show limited detection at the time of analysis. The domain was flagged by 1 of 95 VirusTotal security vendors (Gridinsoft) and appeared on 1 security blocklist (PhishDestroy). Google Safe Browsing did not flag it. The site resolved to the IP address 104.21.112.1, hosted on Cloudflare's infrastructure (AS13335, US location). Nameservers were amalia.ns.cloudflare.com and braden.ns.cloudflare.com. No SSL certificate was present, and the observed page title was 'Time Farm Airdrop'. Registrar and creation date details were not available.

Individuals who interacted with timefarmairdrop.live should immediately revoke any token approvals granted to unknown contracts and transfer remaining funds to a new wallet. If login credentials were entered, change passwords for Revolut and any other accounts where the same credentials were reused, then enable two-factor authentication. Monitor accounts for unauthorized transactions. Report the phishing domain to local cybercrime units, Revolut's security team, and platforms like Google Safe Browsing or PhishTank to aid in broader takedown efforts.