revokecash[.]live

Analysis indicates elevated risk associated with revokecash.live, operating as a brand impersonation campaign targeting Bybit through an "Bybit Audit" themed page. The infrastructure and detection signals indicate malicious intent consistent with credential harvesting or deceptive verification flows.

Infrastructure analysis shows hosting via US-based Cloudflare, Inc. (AS13335), resolving to 172.67.217.120. Domain registration is handled by PDR Ltd. d/b/a PublicDomainRegistry.com, with creation date December 24, 2025. VirusTotal reports 18/95 security vendors detecting the domain. It appears on 1 security blocklist including PhishDestroy. SSL certificate is absent, the page title is "Bybit Audit", and the domain status is currently offline.

Mitigation guidance recommends immediate blocking of the domain at network and DNS layers, updating threat intelligence feeds, and monitoring for credential submission attempts related to Bybit impersonation. Users should avoid interacting with any cached or mirrored content, and security teams should validate related indicators such as IP 172.67.217.120 and associated hosting patterns to prevent reactivation or clone deployment.