cenotaph-app[.]pages[.]dev

This domain is flagged for operating a credential harvesting phishing infrastructure disguised as a secure vault service. Analysis indicates the site presents itself as 'Cenotaph — A vault that holds nothing, and everything,' a deceptive interface designed to trick users into submitting sensitive authentication credentials. The threat actor appears to be leveraging the psychological appeal of secure storage to harvest login details, likely for subsequent account takeovers or identity fraud operations. Infrastructure analysis reveals the domain was registered on April 08, 2026, through Cloudflare, Inc., and currently resolves to the IP address 172.66.47.166. Despite its recent creation, the domain has already been added to one security blocklist, though it remains undetected by antivirus engines, with a VirusTotal score of 0/95. The SSL certificate is issued by Let’s Encrypt, providing a veneer of legitimacy while the Gridinsoft trust score stands at 0/100, reinforcing its high-risk classification. The combination of zero detections on major scanning platforms and a single blocklist entry suggests either evasion techniques or early-stage deployment of the phishing kit. Users who accessed cenotaph-app.pages.dev should immediately revoke any credentials entered on the site, particularly those associated with financial, email, or identity services. It is recommended to monitor accounts for unauthorized access and enable multi-factor authentication where available. Given the domain’s use of Cloudflare’s infrastructure, network administrators should consider blocking traffic to 172.66.47.166 and implementing DNS-based filtering to prevent further exposure. The domain’s current offline status does not eliminate risk, as threat actors may redeploy the phishing kit under a new hostname or IP address.