revo-play[.]website

This domain, revo-play.website, is identified as a credential harvesting phishing site designed to deceive users into submitting sensitive login credentials. Analysis indicates the domain was structured to mimic legitimate platforms, likely targeting users of online services or gaming portals. The infrastructure employed Cloudflare for content delivery and utilized HTTP/3, suggesting an attempt to evade detection through modern web protocols and obfuscate malicious traffic patterns. The domain’s SSL certificate, issued by Let’s Encrypt, further masked its true intent by presenting a seemingly secure connection to potential victims. Evidence supporting the malicious classification includes detection by 6 out of 95 security vendors on VirusTotal, with the domain also appearing in 4 threat intelligence pulses on AlienVault OTX. Registered through NAMECHEAP INC on June 12, 2026, the domain’s creation date aligns with patterns observed in short-lived phishing campaigns. Infrastructure analysis reveals resolution to the IP address 188.114.97.3, a Cloudflare-associated endpoint commonly exploited for anonymity. The domain is currently listed on one security blocklist and was proactively blocked by at least one anti-phishing system, reinforcing its classification as a high-confidence threat. Users who may have interacted with revo-play.website are advised to take immediate remedial actions. Credentials entered on the site should be considered compromised and reset across all platforms where identical or similar passwords were used. System scans using updated security tools are recommended to detect potential malware or unauthorized access. Network administrators should monitor for connections to the IP address 188.114.97.3 and the domain itself in logs, as these may indicate successful phishing attempts or ongoing reconnaissance. Vigilance for follow-up phishing attempts via email or messaging platforms is also warranted, as attackers may leverage harvested data for further exploitation.