humanity-revoke[.]xyz

This domain, humanity-revoke.xyz, is flagged as an active phishing site impersonating a Humanity-branded identity verification service. Registered on June 13, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain currently resolves to Cloudflare IP 188.114.97.3 (Canada) and employs nameservers keaton.ns.cloudflare.com and oaklyn.ns.cloudflare.com. The page title, 'Humanity for Humans – Prove You’re Real, Own Your Identity,' explicitly aligns with known brand impersonation tactics targeting identity or authentication processes. Analysis indicates the use of Framer Sites, React, jsDelivr, Google Tag Manager, and crypto-js, suggesting a modern, script-heavy frontend designed to harvest credentials or personal data. Infrastructure reveals a 301 HTTP redirect, which may lead victims to a secondary malicious endpoint not yet identified. The domain appears on three security blocklists and is referenced in two AlienVault OTX threat intelligence pulses, corroborating its malicious classification. Six security vendors on VirusTotal flag the domain, though the specific nature of detections remains unconfirmed. SSL certification via Google Trust Services (WE1) does not mitigate the threat, as phishing sites commonly use valid certificates to appear legitimate. Defenders should treat this domain as high-risk. Immediate actions include blocking resolution at the DNS or proxy level, adding the domain to endpoint protection denylists, and monitoring for related indicators such as the Cloudflare IP or associated technologies (e.g., crypto-js). Further investigation is required to determine the final redirect destination and any backend infrastructure. Given the domain’s recent registration and active status, assume it is part of an ongoing campaign targeting users under the guise of identity verification.