revoke-bonzo[.]finance

Analysis indicates that revoke-bonzo.finance was registered on July 11, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently active. The domain resolves to the Cloudflare edge address 172.67.215.31 and uses the Cloudflare authoritative nameservers georgia.ns.cloudflare.com and kurt.ns.cloudflare.com. An HTTP request to the host returns a 403 status code, suggesting that direct content retrieval is blocked or restricted. VirusTotal records show that 2 of 91 security vendors have flagged the domain, providing independent confirmation of malicious intent. The classification in the intelligence set is generic_phishing, and the risk level is high. No additional infrastructure such as additional IPs, ASN, or hosting details are available, and the page content has not been publicly analysed, leaving the exact phishing payload unknown. Defenders should treat the domain as hostile: add the FQDN and its resolved IP address to block lists, monitor DNS queries for lookups to the Cloudflare nameservers, and consider updating intrusion detection signatures to flag any outbound connections to 172.67.215.31. Because the domain is newly created, rapid takedown requests to the registrar may be effective, but continuous observation is recommended to detect any further infrastructure evolution.