Is revolut.com safe?

Very Likely Safe

No major red flags found. This looks like a legitimate, established website.

Popular site · #5,097 worldwideChecked Nov 13, 2026

Trust score

Why: Main reasons: domain registered 21+ years ago; not flagged by Google Safe Browsing; revolut is the real brand's registered domain. Minor issues: site returned HTTP 403; missing Content Security Policy.

Identity & Age100/100

Impersonation Risk100/100

Red Flags100/100

Transparency70/100

Security100/100

Email100/100

Positive highlights

Domain registered 21+ years agoLong-established domains are far less likely to be disposable scams.
Not flagged by Google Safe BrowsingNo malware, phishing, or unwanted-software match in Google's live threat database.
HTTPS is enforcedAll redirects stayed on HTTPS. Traffic is encrypted end-to-end.
revolut is the real brand's registered domainThe root label matches the brand exactly — this IS the brand's own domain.
Popular website — ranked #5,097 worldwideListed in the Tranco top 1 million websites. Scam sites are almost never this popular.
HTTPS works with a valid certificateA secure connection was made on port 443. Certificate log details were unavailable at scan time.
No impersonation patterns detectedDomain doesn't look like a typosquat, doesn't embed a well-known brand, and uses ASCII characters.
Not listed on URLhaus malware blocklist
Fast response (246ms)
Not present in PhishStats phishing feed

Negative highlights

Site returned HTTP 403The server is reachable but did not return a success status.
Missing Content Security PolicyRestricts which scripts and resources the page can load.
Large response served uncompressedEnable gzip or brotli at the edge to cut transfer size dramatically.

Note: Registered via INWX GmbH.

Note: 1 technologies detected. Cloudflare

Note: Policy pages could not be checked. The site showed our scanner a bot-check or short page, so privacy, terms and contact pages were not verified. This is common for large sites and is not counted against them.

Key facts about revolut.com

Website: revolut.com
Popularity: #5,097 worldwide (Tranco top 1M)
Domain created: May 4, 2006 (20.5 years old)
Domain expires: May 4, 2032
Registrar: INWX GmbH
Owner details: Public in WHOIS
IP address: 162.159.140.233
Hosting / CDN: Cloudflare
SSL certificate: HTTPS works (certificate details unavailable)
Email security: SPF ✓ · DMARC ✓ (quarantine)
Threat blocklists: Not listed (clean)
Technology: Cloudflare

Summary

93/100 — trusted. Long-established domain (20.5 years old), clean threat reputation, no impersonation patterns.

No malware/phishing on feedsGood reputationHTTPS enabled

Full technical report

Domain Information

Registration timeline, age calculation, registrar details, and ICANN status.

Verified

Registrar Name: INWX GmbH
Creation Date: May 4, 2006 (20.5 years ago)
Last Updated: July 27, 2026
Registry Expiry Date: May 4, 2032
WHOIS Privacy Protection: Publicly Visible
Domain Status Codes: client transfer prohibited

ICANN Status Badges

client transfer prohibited

Open in standalone WHOIS / RDAP Lookup tool →

Domain registered 21+ years ago

Long-established domains are far less likely to be disposable scams.

+15

Registered via INWX GmbH

Owner information disclosed

The domain publishes registrant contact info — a small positive transparency signal.

HTTP Headers & Security

Full HTTP response headers, HSTS, Content Security Policy (CSP), and security baselines.

Good

Security Header Baseline

Strict-Transport-SecurityMissing

Content-Security-PolicyMissing

X-Frame-Options Present

X-Content-Type-Options Present

Referrer-PolicyMissing

Permissions-PolicyMissing

Recommended Missing Headers

missing: Content Security Policy

All Response Headers (20)

accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cf-mitigated: challenge
cf-ray: a59e9fa048dfb86e-CMH
connection: close
content-length: 818330
content-type: text/html; charset=UTF-8
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
date: Fri, 13 Nov 2026 14:56:30 GMT
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=*
referrer-policy: same-origin
server: cloudflare
server-timing: chlray;desc="a59e9fa048dfb86e"
set-cookie: __cf_bm=eEc2seX.K.YjUHzFvFnCt0.oL2Ux0qOCW5YOzbEQrVs-1794581790.7646348-1.0.1.1-a6pdlYQBLj3t0GSxcBh73I7SHeAbx1VK27K31ujW7..nnpH_LWeticvlz7p9Q2bSoi9OjypQ_cAPBX35mJDaDubEzf1jTGuO.hZqIXYtPE87.DCYoTOc_20jvh0Y8tP6; HttpOnly; SameSite=None; Partitioned; Secure; Path=/; Domain=revolut.com; Expires=Fri, 13 Nov 2026 15:26:30 GMT
strict-transport-security: max-age=2592000; includeSubDomains; preload
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN

Inspect all headers in HTTP Header Checker tool →

HSTS is set

Tells browsers to only use HTTPS for this domain.

Missing Content Security Policy

Restricts which scripts and resources the page can load.

-4

X-Frame-Options is set

Prevents clickjacking by disallowing framing.

X-Content-Type-Options is set

Blocks MIME-sniffing browser attacks.

Referrer Policy is set

Controls what referrer information is sent with requests.

Permissions Policy is set

Restricts access to powerful browser features (camera, mic, etc.).

DNS Records

Encrypted DoH resolution: A, AAAA, MX mail servers, authoritative NS, and TXT verification.

Resolved

IPv4 Addresses (A): 162.159.140.233, 172.66.0.231
IPv6 Addresses (AAAA): None
Mail Servers (MX): aspmx.l.google.com (Priority: 1), alt2.aspmx.l.google.com (Priority: 5), alt1.aspmx.l.google.com (Priority: 5), alt4.aspmx.l.google.com (Priority: 10), alt3.aspmx.l.google.com (Priority: 10)
Authoritative Nameservers (NS): ns-cloud-d4.googledomains.com, ns-cloud-d2.googledomains.com, ns-cloud-d1.googledomains.com, ns-cloud-d3.googledomains.com
TXT Records Found: 54 TXT verification records

A Records (IPv4)

162.159.140.233172.66.0.231

TXT Verification Records

35039d909ec30a13dbc9f3894c6ca239f29844c1322b7e64d695273872dd49b6

_szxjgexeof7rmpa3i038fmje0djgyjt

678189f51b3ce2a5d67c166a8ac777440e0c993a23b84d301f725bb84997b148

google-site-verification=CU5aHHDFaIS7rmPsqSE0Pwt2WXNyZt0YBnoiG3A3Rqc

wiz-domain-verification=5855698809e48702af531b9d8049dbab0e250153fdebc3d712611253db1cf329

google-site-verification=QpnQ6Qe8tL0izHlvEBNMZ1CJPagyXcRrx5_3QRoqhEc

VISA=97A654000FAB3C062CAC3619E9F9C0E6

Certeurope=Fgiq7Pvj9CzR824G74JZHrr2MeF3w8

docusign=9aa886dc-315c-406b-a75c-a6bf6db6e8bc

docusign=e89be285-c58c-436a-9483-c0bfa2ca9b16

amazonses:q7YOwQ1cLMnGLTRksFWhJMsh+i8Ajg08QbY8aSgnrG0=

verification_token=6nJlA4vmsz9FGxML8s5RKThu1

jamf-site-verification=k8h7_eApcP1vEEE3x5TlkA

pardot969163=bcff4cc1d8a139eeb479882477f5ce35bf6c3ad61dd5a03b9c44aeaf26358da4

60a5b08a2f480aef4991e6ff691b557fa15ebdec803229cdc855df6bcc995f69

google-site-verification=FvyMDL1jIHpmqVM_Row8cOojeQB3-kIRT2oXNalAYxY

openai-domain-verification=dv-zeXdbzLrKAKVTQrTEUoPzdap

Foxit-domain-verification=f54a9f4d26a25ebdbd5447ac0013d0de

436a12cf57e2df2e19e3bd4cccd5229d6950ac80bd6fa3781de3ef3d2a9fbf9a

zapier-domain-verification-challenge=ba39b827-8ec9-4497-b017-72aa7de4f46c

adobe-idp-site-verification=8b010750c67cbf46c5be78c2e71a28f0211964e09395094a3da0b494dbc651f3

MS=ms73364798

v=spf1 include:_spf.google.com include:mail.zendesk.com include:_spf.atlassian.net include:_spf.salesforce.com include:_spf.sparkpostmail.com ~all

atlassian-sending-domain-verification=4952210b-0a37-4050-9a55-ce2c58fa8b28

jetbrains-domain-verification=dsa98mjgew5wx4h64rum7zitj

5a3687060ef94980f6da0f909097b8d8f2e8b8ac5718e0fbd17bb0596ef3121f

cursor-domain-verification-sy3hkv=1ZyJzWDtlr5B2kUt7nzYB62MB

f1d42c8c84f7179e61cd0d3fdb5da375bd081e44090c7769936e9f0aca343cf9

067ad03f127e069f7f7aa2360cf866845c0f3f35a71d667e7d1c8dc1cd6f384d

google-site-verification=OXSc6c_1hvbBupLkGnAojCeg21KLxS9_0hJm4Fl5KQs

364227379ef2a02c552e43077718593604053c2fbeee4b0a12c370b8cf4ce088

VISA=C2C643F71D0B04C4589EE3BBEE8620F6

mtc=YmEyYzAwNWUtZmE2ZS00NGUxLThjODYtMDRlZGRlMWUwN2Iy

apple-domain-verification=9QFO4rtc1CwwuJZW

ORUvC5FWkczlsgpQD41EiQ

atlassian-domain-verification=Mzbg6ekGcURWMWeIFPczmNvMDO5QI6FVn3RlnpBVNX+H8EpKVkcJjvwLGVkqUxAa

_sq9cnlva91hma9r9attizpaqeis9ovp

serval-domain-verification-9c6c02=cEIzrHyeHnAVd7xUk26tCkXfP

125520735

VISA=E08F11962574D50E1C9C150D6CD09EB8

google-site-verification=J50mEx511qzmeTPOsUU3aZKLmzw6fKn1loRDuzfppUM

862281804

drift-domain-verification=2b5de3adf04e3120a8c9605ed8fbe18280867c93162d8b8a810414a0ed94afb4

atlassian-domain-verification=3f09F8xwF6p3RmwdwQJHxQdjb8gaKNMWriwUv1Q084JbPSvRNV+HM63xtoL72ENj

mtc=NDljMjNkNmYtNTVkZS00MjI2LTg2M2UtYzdhZDcyZGY2NjRj

google-site-verification=xX_fEjrjlZ3HH1z3z0hRZMt7ddvhhqt5lMzm_z46Qrg

_58tw41qgnggbur4s48p0gmeds1w2n4r

anthropic-domain-verification-5fpm85=h9V4qLU6UpKu0vTH3VjnBZ6u3

00D8d000001xy3T=1TBTu000000003F

08bc6f84b232f61558b5c23cfc326216c3e752e58407265048ba5a98d7057001

google-site-verification=w-FzBu1VDsU0MXdPY53ZXz-KYtXb-gmzZTr-QCzIKVc

too3o9112f5ioqpu133a5kgl6i

h1-domain-verification=jwDB6VRcNMMMKRdsNpP2nDe3fTwSEa7H84eZm2ai62vx13Bu

VDJzVD16Woc2iWGs1fFQ2QOf+0ts75OHbERHEVFG7oU=

Run live DNS resolution in DNS Lookup tool →

2 address record(s) resolved

4 authoritative nameservers

WHOIS & Identity Lookup

Domain ownership status, registry lifecycle, nameservers, and privacy redaction.

Found

Registrable Domain: revolut.com
Registrar Organization: INWX GmbH
WHOIS Privacy Status: Public Registration Data
Registry Status Codes: client transfer prohibited
Delegated Authoritative Nameservers: ns-cloud-d1.googledomains.com, ns-cloud-d2.googledomains.com, ns-cloud-d3.googledomains.com, ns-cloud-d4.googledomains.com
Registration Lifecycle: Registered: 2006 → Expires: 2032

Nameservers (NS)

ns-cloud-d1.googledomains.comns-cloud-d2.googledomains.comns-cloud-d3.googledomains.comns-cloud-d4.googledomains.com

Run dedicated WHOIS query for revolut.com →

Domain registered 21+ years ago

Long-established domains are far less likely to be disposable scams.

+15

Registered via INWX GmbH

Owner information disclosed

The domain publishes registrant contact info — a small positive transparency signal.

Email Security & Deliverability

SPF record validation, DMARC policy enforcement, DKIM selectors, and MX reputation.

Protected

SPF Record: v=spf1 include:_spf.google.com include:mail.zendesk.com include:_spf.atlassian.net include:_spf.salesforce.com include:_spf.sparkpostmail.com ~all
DMARC Policy Mode: Policy: QUARANTINE
DMARC Raw Record: v=DMARC1; p=quarantine; pct=100; sp=quarantine; rua=mailto:revolut@rua.netcraft.com,mailto:dmarc@revolut.com; ruf=mailto:revolut@ruf.netcraft.com,mailto:dmarc@revolut.com;
DKIM Selectors Detected: google, s1, s2

Email Protection Summary: This domain has strong email authentication configured to prevent spammers from sending emails impersonating this brand.

Test email deliverability in Email Reputation tool →

SPF record published

DMARC published (quarantine)

DKIM configured (google, s1, s2)

Threat Intelligence & Blocklists

Multi-source malware feeds (URLhaus), phishing checks (PhishStats, Safe Browsing), and typosquats.

Clean

URLhaus Malware

Clean / Not Listed

PhishStats Feed

Clean / Not Listed

Google Safe Browsing

Clean / Verified

Root Domain Label: revolut
Top-Level Domain (TLD): .com (Standard TLD)
Punycode Obfuscation: No (Standard ASCII)
Homoglyph / Lookalike Script: No mixed scripts
Brand Match Analysis: Official Domain (revolut)
Typosquatting Risk: Clean

revolut is the real brand's registered domain

The root label matches the brand exactly — this IS the brand's own domain.

+10

No impersonation patterns detected

Domain doesn't look like a typosquat, doesn't embed a well-known brand, and uses ASCII characters.

Technology Stack & Metadata

Detected CMS, JavaScript frameworks, analytics tags, CDN providers, and page metadata.

Detected

Detected Technologies by Category

cdn

Cloudflare

Page Metadata & Fingerprint

HTML Title: —
Meta Description: —
Document Language: en-GB
Character Encoding: utf-8
Viewport Setting: width=device-width
Generator Software: —

Fingerprint tech stack in Technology Detector tool →

1 technologies detected

Cloudflare

Page Performance & Compression

Server response time, content payload size, Brotli/Gzip compression, and caching rules.

246ms

Items to Fix & Optimize

Text compression (Brotli/Gzip)

MUCH NEEDEDEnable on server or CDN

Modern image formats (WebP/AVIF/SVG)

OPTIONALConvert heavy images to WebP/AVIF

Protocol

HTTP/2

Binary framing, multiplexed

Compression

NONE

No compression detected

Optimization Signals (From Detectable Headers & Assets)

Image Formats

Legacy / Unchecked

Transfer

Uncompressed

Transport

HTTP/2

These are server-side signals. Actual Core Web Vitals (LCP, INP, CLS) require real-user measurement via PageSpeed Insights.

Detected Asset & Image Formats

WebPAVIFSVGJPEGPNG

HTTP Response Time: 246 ms
Payload Body Size: 799.2 KB
Compression Status: Uncompressed
Cache Directives: Standard caching rules

Large response served uncompressed

Enable gzip or brotli at the edge to cut transfer size dramatically.

-3

AI Content Safety & Red Flags

High-pressure language, payment gateway safety, disposable domain analysis, and deceptive tactics.

Safe

AI Content Evaluation

93/100 — trusted. Long-established domain (20.5 years old), clean threat reputation, no impersonation patterns. Main reasons: domain registered 21+ years ago; not flagged by Google Safe Browsing; revolut is the real brand's registered domain. Minor issues: site returned HTTP 403; missing Content Security Policy.

Payment Red Flags: None (No suspicious payment requests)
High-Pressure Language: None (No artificial urgency detected)
Disposable Domain Risk: No (Established infrastructure)
Text Scanned Depth: 524,113 characters verified

No scam-correlated language found on the home page

No crypto-only / gift-card / wire-only payment demands, and no obvious urgency tactics.

Server & Hosting Infrastructure

Primary IP address, web server software, CDN edge network, and redirect hop chain.

cloudflare

Primary Web Server: cloudflare
CDN / Cloud Provider: Cloudflare
Primary IP Address: 162.159.140.233
HTTP Status Code: 403 OK
Final Landing Destination: https://www.revolut.com/
Redirect Hop Count: 1 hop

Redirect Hop Chain

1.https://revolut.com/ → https://www.revolut.com/

Lookup IP & ASN in IP Lookup tool →Trace redirects in URL Expander tool →

Site returned HTTP 403

The server is reachable but did not return a success status.

-6

HTTPS is enforced

All redirects stayed on HTTPS. Traffic is encrypted end-to-end.

+10

Fast response (246ms)

Served through Cloudflare

Sites behind a major CDN benefit from DDoS protection and edge caching.

SSL / TLS Certificate

Active Certificate Authority, Common Name, validity period, expiration countdown, and SANs.

Secure

Certificate Authority (Issuer): Not available (certificate logs did not respond)
Subject Common Name (CN): —
Validity Period: Not available
Subject Alternative Names (SANs): 1 domain protected
Certificates Logged (CT): Verified in live TLS

Subject Alternative Names (Sample)

revolut.com

Check certificate history in SSL Checker tool →

HTTPS works with a valid certificate

A secure connection was made on port 443. Certificate log details were unavailable at scan time.

Content & Transparency Policies

Linked privacy policy, terms of service, about page, social channels, and published contacts.

Warning

Key Legal & Transparency Pages

privacy PageNot linked

terms PageNot linked

contact PageNot linked

about PageNot linked

refund PageNot linked

shipping PageNot linked

cookies PageNot linked

Policy pages could not be checked

The site showed our scanner a bot-check or short page, so privacy, terms and contact pages were not verified. This is common for large sites and is not counted against them.

Robots.txt & Sitemap Discoverability

Search engine crawler directives, indexability, and declared XML sitemaps.

Present

Robots.txt Directives: Present & Configured
Sitemaps Declared: https://www.revolut.com/sitemap-index.xml
Disallow Rules Count: 57 rules

View Raw robots.txt

# *
User-agent: *
Allow: /sitemap-*.xml*
Disallow: /api/
Disallow: */email-verification
Disallow: */help-centre
Disallow: /*.json$
Disallow: /*_buildManifest.js$
Disallow: /*_middlewareManifest.js$
Disallow: /*_ssgManifest.js$
Disallow: /*embedded
Disallow: /*/query:*
Disallow: *?*
Allow: *?amount=
Allow: *?amount-to=
Disallow: */api/*amount*

# Localisation send money
Disallow: /en-AT/money-transfer/send-money
Disallow: /en-BE/money-transfer/send-money
Disallow: /en-BG/money-transfer/send-money
Disallow: /en-BR/money-transfer/send-money
Disallow: /en-CL/money-transfer/send-money
Disallow: /en-CZ/money-transfer/send-money
Disallow: /en-CZ/money-transfer/send-money
Disallow: /en-DE/money-transfer/send-money
Disallow: /en-ES/money-transfer/send-money
Disallow: /en-FR/money-transfer/send-money
Disallow: /en-GR/money-transfer/send-money
Disallow: /en-HR/money-transfer/send-money
Disallow: /en-HU/money-transfer/send-money
Disallow: /en-IT/money-transfer/send-money
Disallow: /en-JP/money-transfer/send-money
Disallow: /en-LT/money-transfer/send-money
Disallow: /en-MX/money-transfer/send-money
Disallow: /en-PL/money-transfer/send-money
Disallow: /en-PT/money-transfer/send-money
Disallow: /en-RO/money-transfer/send-money
Disallow: /en-SK/money-transfer/send-money
Disallow: /en-EC/money-transfer/send-money
Disallow: /en-EE/money-transfer/send-money
Disallow: /en-AZ/money-transfer/send-money
Disallow: /en-LV/money-transfer/send-money
Disallow: */international-transfers/

# Localisation currency converter
Disallow: /en-ES/currency-converter/convert
Disallow: /en-BG/currency-converter/convert
Disallow: /en-CZ/currency-converter/convert
Disallow: /en-DA/currency-converter/convert
Disallow: /en-DE/currency-converter/convert
Disallow: /en-GR/currency-converter/convert
Disallow: /en-AZ/currency-converter/convert
Disallow: /en-FR/currency-converter/convert
Disallow: /en-HR/currency-converter/convert
Disallow: /en-HU/currency-converter/convert
Disallow: /en-IT/currency-converter/convert
Disallow: /en-JP/currency-converter/convert
Disallow: /en-LT/currency-converter/convert
Disallow: /en-NL/currency-converter/convert
Disallow: /en-PL/currency-converter/convert
Disallow: /en-BR/currency-converter/convert
Disallow: /en-RO/currency-converter/convert
Disallow: /en-LV/currency-converter/convert
Disallow: /en-SE/currency-converter/convert
Disallow: /en-SL/currency-converter/convert

# Sitemap, Host
Sitemap: https://www.revolut.com/sitemap-index.xml
Host: https://www.revolut.com

robots.txt published

Export & Share Intelligence

Download the complete official PDF verification report (all sections and technical signals expanded), or export raw JSON telemetry.

Scan Engine Performance

Automated multi-signal inspection pipeline

v5.1.0 Engine

Signals Analyzed

This scan

Sources Checked

Live security feeds

Scan Duration

2.67s

Fast scan

Last Scan

11/13/2026

Live timestamp

Overall Risk

Low Risk

User reviews of revolut.com

No reviews yet. Be the first to share your experience.