lemonfresh[.]com[.]pl

Analysis indicates lemonfresh.com.pl remains active as of the July 12 2026 report date with a generic_phishing classification and high risk level. The domain was registered through home.pl S.A. on September 02 2010 and continues to resolve to IP address 188.128.239.32. Its SSL certificate is also issued by home.pl S.A. The observed page title matches Pralnia Lemon Fresh | Pierzemy wszystko … prócz kieszeni exactly, confirming the site presents laundry-service branding. Infrastructure details tie the domain to a long-lived registration that now appears across multiple detection sources.

Detection telemetry shows the domain listed on three security blocklists and explicitly blocked by PhishDestroy, PhishingDB and BLP-Malware. AlienVault OTX records place it in 50 threat intelligence pulses, while VirusTotal reports detections from 12 of 95 vendors. Gridinsoft assigns a trust score of 1 out of 100. These quantitative indicators establish consistent malicious classification without reliance on any single vendor.

The exact phishing kit or target brand beyond the supplied page title remains unconfirmed from the available data. No additional ASN, geolocation, or campaign attribution appears in the intelligence set. Because the domain predates the current report by more than fifteen years, defenders cannot assume recent registration as an indicator; instead, the combination of blocklist presence, OTX pulse count, and vendor detections forms the primary evidence.

Defenders should block 188.128.239.32 at network egress points, add lemonfresh.com.pl to internal DNS sinkholes, and monitor for any related subdomains or newly observed certificates from the same issuer. Continued observation of the three blocklist entries and the 50 OTX pulses will indicate whether the infrastructure is expanding or being repurposed. All detections should be cross-checked against the reported high-risk status before adjusting perimeter rules.