revokcash[.]xyz

On 25 July 2026, revokcash.xyz was observed as part of a generic phishing operation. The domain resolves to 172.67.138.21, an address owned by AS13335 Cloudflare, Inc. in the United States. DNS resolution is served by lucy.ns.cloudflare.com and pablo.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited; no SSL certificate was presented at the time of collection, and the site returned an HTTP status indicating it is currently taken offline. The page title returned by the server was “Flower Portfolio and Care Guide”, which does not correspond to a known legitimate brand and suggests a lure unrelated to the phishing payload.

The domain is listed on one security blocklist and has been actively blocked by the PhishDestroy mitigation service. VirusTotal analysis shows that six of ninety‑five scanners flagged the domain, reinforcing the suspicion of malicious use. The absence of an SSL certificate means that any HTTP traffic would be transmitted unencrypted, a common characteristic of low‑cost phishing sites that rely on rapid domain turnover rather than persistent credential capture. Cloudflare’s front‑end protection can obscure the true origin of the hosting server, complicating attribution efforts. Because the domain is already flagged by multiple security vendors, automated blocklists are likely to propagate the indicator to endpoint protection products.

However, the limited number of detections suggests that the domain may have been observed for a short window before being taken down. The precise phishing template and target victims remain uncertain, and no additional artifacts such as payload samples or credential‑stealing forms have been publicly released. Defenders should add revokcash.xyz to URL filtering rules, monitor traffic to its Cloudflare IP address, and consider blocking the associated nameservers if broader mitigation is required.