perfectfacilities[.]co[.]uk

This domain is flagged as a high-risk generic phishing threat, specifically designed as a fake login portal to harvest user credentials. Analysis indicates the infrastructure was established to mimic legitimate corporate or service provider login pages, a common tactic for credential theft and subsequent unauthorized access to sensitive systems or accounts. Infrastructure analysis reveals the domain perfectfacilities.co.uk was registered on February 21, 2026, through Register.com Inc t/a Network Solutions. It resolves to the IP address 109.228.34.21, hosted on AS8560 (IONOS SE) in the United Kingdom. The domain appears on one security blocklist and is flagged by Google Safe Browsing as phishing. VirusTotal reports 18 out of 95 security vendors detecting the domain as malicious. The SSL certificate is issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36 intermediate, a common certificate authority exploited in phishing campaigns due to its low validation requirements. Mitigation steps for this specific threat type include immediate blocking of the domain and its resolving IP (109.228.34.21) at the network perimeter. Security teams should deploy indicators of compromise (IOCs) across endpoint detection and response (EDR) and security information and event management (SIEM) systems to detect any attempted connections. User awareness training should emphasize the risks of fake login portals, particularly those mimicking corporate or service provider authentication pages. Additionally, organizations should monitor for unauthorized access attempts from credentials potentially compromised through this domain, as phishing victims often reuse passwords across multiple platforms.