revoke-afx[.]app

Analysis of revoke-afx.app shows a newly registered domain created on July 23, 2026 and currently resolving to the IP address 188.114.96.3. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and uses Cloudflare nameservers kip.ns.cloudflare.com and meera.ns.cloudflare.com, indicating the hosting infrastructure is provided by Cloudflare. The domain appears on a single security blocklist and is actively blocked by PhishDestroy, confirming that at least one external threat‑intelligence source has identified it as malicious.

VirusTotal records indicate the site has been scanned by 91 antivirus and URL‑reputation vendors; none have generated a detection, but the absence of a flag does not constitute evidence of safety. No public page title, brand target, or detailed content analysis is available, so the precise phishing lure or credential‑harvesting technique employed by the site cannot be confirmed at this time. Defenders should treat the domain as a high‑confidence indicator of a generic phishing campaign and implement preventive controls: block DNS resolution for revoke-afx.app at network perimeter, add the associated IP 188.114.96.3 to outbound deny lists, and monitor Cloudflare‑associated traffic for anomalous patterns.

Continuous re‑evaluation is advised, as additional telemetry such as URL snapshots, SSL certificate details, or HTTP response codes may emerge and refine the threat characterization. The current risk level remains under investigation, and organizations should maintain heightened vigilance for any attempts to lure users to this domain.