verifypof[.]live

The domain verifypof.live has been identified as a credential theft operation impersonating the Plenty of Fish (PoF) platform. Analysis indicates the site was designed to harvest user login credentials through deceptive login portals, a tactic commonly employed in targeted credential phishing campaigns. As of the latest assessment, the domain has been taken offline, though residual risk may persist due to cached or archived copies. Infrastructure analysis reveals the domain was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. It resolved to the IP address 104.21.85.4, a Cloudflare-hosted endpoint often leveraged to obfuscate origin servers. Detection metrics indicate the domain was flagged by 5 of 95 security vendors on VirusTotal, while three distinct security blocklists have listed it as malicious. The SSL certificate, issued by Google Trust Services, aligns with legitimate encryption standards but does not mitigate the underlying threat. Additional indicators include the page title 'Nur einen Moment…', a common placeholder used in transient phishing pages to simulate loading states. Current status confirms the domain is offline, though the infrastructure may remain dormant for future reactivation. Organizations and users are advised to block the domain and its associated IP at perimeter defenses, including firewalls and DNS filters. Endpoint protection systems should be updated to recognize the domain as a credential theft vector, particularly for users accessing dating or social platforms. Security teams should monitor for residual access attempts from cached DNS entries or archived phishing pages. Given the elevated risk profile, affected users should immediately reset credentials on any accounts accessed via this domain and enable multi-factor authentication where available.