revoke-coldcard[.]xyz

The domain revoke-coldcard.xyz is currently listed on a single security blocklist and is actively blocked by the PhishDestroy service. VirusTotal records show that the domain has been scanned by 91 antivirus and URL‑reputation engines, none of which have raised a detection at the time of analysis. The lack of detections does not constitute evidence of benign behavior; it may reflect limited coverage, recent deployment, or evasion techniques that have not yet triggered signatures.

No additional infrastructure details such as registrar information, IP address, ASN, hosting provider, SSL certificate data, or HTTP response codes are publicly available in the supplied intelligence. Likewise, page‑title metadata, Safe Browsing status, or any associated threat‑actor identifiers have not been disclosed. Because the domain is marked as active and under investigation, defenders should treat it as potentially malicious until further context is obtained.

Recommended mitigations include adding revoke-coldcard.xyz to network‑level deny lists, configuring web‑gateway filters to block HTTP requests to the domain, and monitoring DNS query logs for any outbound resolution attempts. Security teams should also query threat‑intel platforms for any emerging indicators that may augment the current profile, and consider sharing observed traffic with community blocklists to improve collective detection capability.