cent[.]lol

This domain, cent.lol, is flagged for credential harvesting phishing activity with an elevated risk classification. The threat involves redirecting users to fraudulent login portals designed to capture authentication details, including usernames, passwords, and potentially multi-factor authentication codes. Analysis indicates the domain is actively serving malicious content, as evidenced by its page title 'Redirecting...' and the use of server-side redirection techniques commonly employed in phishing campaigns. Infrastructure analysis reveals the following technical indicators: cent.lol is detected by 7 out of 95 security vendors on VirusTotal, indicating moderate but non-negligible detection coverage. The domain resolves to IP address 172.234.24.211 and employs a Let's Encrypt SSL certificate, which provides encryption but does not validate legitimacy. It appears on one security blocklist and is specifically blocked by a phishing-focused detection system. The domain was registered through Namecheap on April 21, 2026, a future date suggesting falsified registration details. Backend technologies include Nginx and OpenResty, a combination frequently used in both legitimate and malicious web infrastructure. Mitigation steps should focus on preventing user interaction with the domain and containing potential exposure. Network-level blocking of 172.234.24.211 and cent.lol is recommended for all endpoints and perimeter security devices. Security teams should monitor for connections to this IP or domain in proxy logs, DNS queries, and firewall traffic. If any user interaction is confirmed, immediate credential rotation should be enforced for all potentially exposed accounts, particularly those associated with enterprise services. Additionally, security awareness training should reinforce recognition of redirect-based phishing tactics, emphasizing the risks of domains with unusual TLDs and unexpected login prompts.