en-blackhole[.]pages[.]dev

This domain, en-blackhole.pages.dev, is identified as a credential theft operation targeting users through a deceptive interface labeled 'Blackhole.' The site is designed to harvest login credentials, likely for financial or cryptocurrency-related accounts, by presenting a fraudulent authentication prompt or phishing form. Analysis of the page title and structure suggests an intent to exploit users familiar with the term 'Blackhole,' which may be associated with underground forums or malicious toolkits, increasing the likelihood of successful social engineering attacks. Infrastructure analysis reveals the domain was registered on August 17, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.44.127. Despite its recent creation, the domain appears on one security blocklist, though it remains undetected by VirusTotal, with 0 out of 95 engines flagging it as malicious. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy to unsuspecting visitors. The domain's current offline status may indicate takedown efforts or a temporary pause in operations, but historical exposure cannot be ruled out. Users who visited en-blackhole.pages.dev should immediately revoke any credentials entered on the site, particularly those linked to financial services, email accounts, or cryptocurrency wallets. Monitor associated accounts for unauthorized transactions or login attempts, and enable multi-factor authentication where available. If browser sessions were active during the visit, clear all cached data and cookies to eliminate residual tracking mechanisms. Organizations should update internal blocklists to include this domain and its resolving IP, while security teams should investigate potential lateral movement or follow-up attacks stemming from compromised credentials.