app[.]perle[.]lat

Analysis of the domain app.perle.lat shows infrastructure consistent with a newly registered phishing portal. The domain was created on February 27, 2026 and is delegated to the Cloudflare nameservers audrey.ns.cloudflare.com and rohin.ns.cloudflare.com. DNS resolution points to the address 104.21.48.133, an IP owned by AS13335 Cloudflare, Inc., located in the United States. No TLS certificate is presented, indicating that HTTPS is not configured for this host. A HTTP request to the site returned the page title "Just a moment...", which offers no additional context about the intended victim lure.

The domain is currently taken offline, but it was previously listed on a single security blocklist, specifically PhishDestroy, suggesting it has been identified as a phishing vector. VirusTotal records indicate that the URL was scanned by 93 antivirus and URL‑reputation engines, none of which raised a detection at the time of scanning; this absence of detections does not confirm safety, only that the content was not flagged by those engines. Registration was performed through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar known for bulk registrations but not directly implicated in malicious activity. The available evidence does not reveal the specific brand or service being spoofed, nor does it provide details about any credentials or payload delivered by the site.

Uncertainty remains around the actual content that was served while the domain was active, the presence of any credential‑harvesting forms, and whether the site employed additional redirection or obfuscation techniques. Defenders should block the domain at network perimeter and DNS resolvers, monitor for any re‑activation or changes to the DNS records, and continue to scan the URL with dynamic analysis tools should it come back online. Adding the domain to threat intelligence feeds and correlating any future traffic with known phishing campaigns will aid in early detection.