permfruits[.]com

The domain permfruits.com is actively hosting a credential phishing operation as indicated by multiple intelligence sources. The site resolves to the IP address 34.149.120.3, which is associated with a US‑based cloud hosting environment. Registration details show the domain was created on February 5, 2026 through a registrar linked to Dynadot LLC, and the current DNS configuration points to two SiteGround name servers. An HTTP request to the site returns a 403 status code, suggesting restricted access that is typical for phishing pages that serve content only to targeted victims. Infrastructure analysis detected web server software and an embedded analytics tag, confirming a functional web presence. The TLS certificate is a free issuance, reinforcing the low‑cost nature of the deployment. Reputation scoring is poor, with a Gridinsoft trust rating of 20 out of 100, and the domain appears on at least one security blocklist, including PhishDestroy. Virus scanning records show four of ninety‑one security vendors flag the domain, providing additional corroboration of malicious intent. The observed scam type is explicitly credential phishing, targeting user login credentials. While the site’s visual content has not been examined, the technical indicators collectively establish a high‑risk profile. Defenders should block permfruits.com at DNS and proxy layers, enforce TLS inspection to capture any credential submissions, and monitor for related activity from the hosting IP range. Ongoing observation is advised to capture any evolution of the threat infrastructure.