revo-revolution[.]click

Analysis of the domain revo-revolution.click indicates a high-risk brand impersonation campaign targeting MetaMask users. The domain was registered on August 25, 2025, through Dynadot LLC, a registrar frequently observed in phishing operations. As of July 12, 2026, the domain remains active and resolves to the IP address 104.21.39.26, which is associated with Cloudflare infrastructure. The use of Cloudflare and HTTP/3 suggests efforts to obscure hosting origins and enhance delivery speed, while the presence of reCAPTCHA may be intended to evade automated detection systems. The domain is flagged by six out of ninety-five security vendors on VirusTotal, and it appears on two security blocklists, including PhishDestroy and BLP-Malware. AlienVault OTX records show the domain in twenty-three threat intelligence pulses, indicating repeated identification in malicious activity reports. The page title, $Revo, aligns with common patterns observed in cryptocurrency-related scams, though the exact content and functionality of the site have not been analyzed. The SSL certificate issued by Google Trust Services does not mitigate the risk, as legitimate certificates are routinely exploited in phishing campaigns to create a false sense of security. Defenders should treat this domain as an active threat to users of MetaMask or similar cryptocurrency wallets. The combination of brand impersonation, Cloudflare hosting, and detection by multiple security vendors supports a classification of high risk. Network-level blocking of 104.21.39.26 and the domain itself is recommended for organizations seeking to prevent potential credential theft or wallet compromise. Monitoring for additional domains registered through the same registrar or resolving to the same IP may help identify related campaigns. Given the domain’s age and continued activity, it is likely part of a broader, persistent operation rather than an isolated incident.