revanced[.]to

Analysis of revanced.to indicates a high-risk phishing domain actively impersonating Facebook, despite its page title suggesting a ReVanced APK download. The domain was registered on October 11, 2023, through NameCheap, Inc., and is currently resolving to IP address 104.21.51.73, hosted on Cloudflare's infrastructure (AS13335). Nameservers point to Cloudflare (ignat.ns.cloudflare.com and lindsey.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns. The site is flagged by one security blocklist and detected by 3 of 95 security vendors on VirusTotal, though the specific nature of these detections remains unverified. Technologies identified include WordPress, MySQL, PHP, and HTTP/3, suggesting a structured backend likely used to host phishing kits or distribute malicious payloads. The domain's page title, 'ReVanced v20.14.43 - Download YouTube ReVanced APK (2025)', does not align with its confirmed brand impersonation of Facebook, indicating either a bait-and-switch tactic or a multi-purpose phishing infrastructure. The discrepancy between the advertised content and the actual threat type raises concerns about the domain's versatility in targeting victims. The SSL certificate, issued by Google Trust Services (WE1), is valid but does not mitigate the malicious intent, as phishing sites frequently use legitimate certificates to appear trustworthy. Defenders should treat this domain as an active threat. Blocking the IP 104.21.51.73 and associated Cloudflare ranges, as well as monitoring for connections to the nameservers, is recommended. Given the domain's age and continued activity, it is likely part of a broader campaign. Further investigation into the WordPress and PHP components may reveal additional indicators of compromise, such as embedded malicious scripts or redirect chains. Organizations should also review logs for any user interactions with this domain, particularly those involving Facebook credentials or APK downloads.