Is revokeonondo.live a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website presents itself as "Ondo Finance — Revoke Token Access", a single-purpose page that appears to offer a tool for revoking token approvals. Its domain name and page title borrow the name of a known finance brand. Its apparent purpose is to get visitors to take token-permission or wallet-related actions under that brand's name.

Scam/Impersonation Risk

The evidence converges on an elevated, cautionary risk. The domain is blacklisted. Several independent security engines currently flag it as malicious, including three tier-one vendors, and a threat-intelligence kill-switch is active. These external detections are the decisive finding, and no technical control on the site offsets them. The framing adds to the concern. A "revoke token access" page under a finance brand's name is the kind of lure that normally steers visitors into connecting a wallet and signing approvals, which is how permissions are harvested. Nothing captured links the domain to the real brand, and the homepage gives no independent basis for treating the brand reference as legitimate. The sandbox runs found no wallet-connection prompt, no hidden forms, no clipboard manipulation and no cloaking, so no active drainer behaviour was reproduced. That does not outweigh the reputational findings, because a page can change what it serves after the sandbox visit. The runs did show an unusually high share of externally sourced resources and a high rate of scripted console errors, which suggests an unpolished or templated build. No conflicting legal identities and no confirmed phishing classification were found, so the risk rests on the blacklisting and the brand-borrowing context. Evidence:

• Homepage title reads "Ondo Finance — Revoke Token Access", and the domain name embeds the same brand reference.
• Homepage sandbox runs (three, all completed) recorded no external data submissions, no wallet-provider activity and no password forms, but 18 console errors and a high proportion of externally loaded resources.
• Reputation checks across multiple security engines return malicious detections, including from Fortinet, Kaspersky and Sophos, and the external blacklist is confirmed.

Regulatory Verification Notes

The captured homepage presents no operator name, licence, registration number or legal-entity details, and its relationship to the brand it names cannot be established from the material available. That is a disclosure gap on the site's own content, not a regulatory finding, and no third-party broker or regulator record matched this domain. The domain's trust profile is driven by the threat detections, not by licensing. Technical hygiene is conventional and consistent with a commodity deployment: valid transport encryption, but only basic domain-validated assurance, which says nothing about who operates the site. Evidence:

• Served from AS16509 (AMAZON-02 - Amazon.com, Inc., US), registry ARIN, country US.
• TLS certificate issued by YR1 at domain-validated (DV) level, valid to 2026-12-12 (44 days remaining at assessment).
• Homepage text (about 1,569 characters) contains no legal-entity, licensing or registration disclosure.

What to Verify Next

Before any interaction, confirm independently whether the real Ondo Finance brand operates or endorses this domain. Use only addresses obtained from the brand's official channels and do not follow links from this page. Treat any approval-revocation or token-management task as one to run through a well-known, independently sourced tool, not through this site. If the domain was reached through a message, advertisement or social post, the sender should be checked through a separate route, and the message should be reported if it cannot be authenticated. Re-check the domain's reputation after any claimed remediation, since the current detections are active. Evidence:

• The homepage ties its function to a named finance brand without any visible operator or endorsement information.
• Security engines flag the domain today, so the reputational picture should be re-checked before any change in posture.

Summary Verdict

The site sits in the lowest trust tier, with a clearly high-risk posture driven by active malicious detections that no other signal offsets. Its identity is unconfirmed, and the brand-linked framing is unsubstantiated. The sandbox's lack of overtly malicious behaviour reduces the evidence of active exploitation but does not establish safety.

Infrastructure Integrity

The site is served from Amazon-hosted address space behind a CDN/WAF, with only edge addresses visible and the origin server hidden. That conceals the real hosting and allows content to be swapped quickly, which limits independent verification. The CDN is a mitigating factor only and cannot offset the threat detections. The 270 abuse reports seen against the edge address belong to a shared provider IP serving many customers, so they are discounted and not attributed to this site.

Closing Assessment

This site should not be used for login, credential entry, wallet connection, token approvals or any financial action. If it was already visited, any wallet that connected or signed should have its approvals reviewed through an independently sourced tool and should be treated as potentially exposed. Read-only viewing in an isolated environment is the outer limit of acceptable interaction.

Signals weighed against the site

• AbuseIPDB: 270 reports on hosting IP 216.198.79.1 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.