scan[.]solrevoke[.]org

Analysis of scan.solrevoke.org indicates a wallet and seed-phishing domain impersonating the Across protocol, active as of July 23, 2026. The domain was registered on February 21, 2026, and resolved to IP address 104.21.29.161, hosted on Cloudflare's network (AS13335). The page title, 'Sol Revoke — Solana Permission Scanner | Protect Your Wallet,' suggests a fraudulent Solana wallet permission scanner designed to deceive users into exposing private keys or seed phrases.

Four of 93 security vendors on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist, including PhishDestroy. The domain's SSL certificate is issued by WE1, and its Gridinsoft trust score is 0/100, reinforcing its classification as a high-risk phishing site. As of the report date, the domain has been taken offline, though residual DNS or cached content may still pose a threat.

Defenders should monitor for related infrastructure, particularly domains mimicking wallet security tools or permission revocation services, and update blocklists accordingly. The exact phishing mechanism remains unconfirmed due to the domain's current offline status, but the combination of brand impersonation, low detection thresholds, and wallet-focused scam type aligns with known crypto-drainer campaigns. No additional hosting providers, registrar details, or Safe Browsing status were provided in the available intelligence.