peraj[.]com

This domain, peraj.com, is actively engaged in credential theft operations, designed to harvest user login credentials through deceptive login portals. Analysis indicates the site employs social engineering tactics to impersonate trusted platforms, tricking visitors into entering usernames, passwords, and other sensitive authentication details. The stolen credentials are likely exfiltrated to attacker-controlled infrastructure for further exploitation, including account takeovers, financial fraud, or lateral movement in compromised networks. Infrastructure analysis reveals concrete indicators of malicious activity. The domain was registered on May 10, 2002, through PDR Ltd. d/b/a PublicDomainRegistry.com, and currently resolves to the IP address 207.174.215.130, hosted on AS46606 (Unified Layer). Security vendors have flagged peraj.com on VirusTotal, with 5 out of 95 engines detecting malicious behavior. Additionally, the domain appears on one security blocklist, and its SSL certificate, issued by Let's Encrypt (YR2), does not mitigate the underlying threat. The prolonged registration period and active status further suggest a persistent campaign rather than a short-lived phishing attempt. Users who have visited peraj.com or entered credentials on the site should take immediate action to mitigate risk. First, revoke any sessions or logins associated with the domain and change passwords for all accounts where the same credentials may have been reused. Enable multi-factor authentication (MFA) on critical accounts to prevent unauthorized access. Monitor financial and communication platforms for unusual activity, as stolen credentials may be leveraged for fraud or identity theft. If corporate or enterprise credentials were exposed, report the incident to internal security teams for further investigation and containment. Finally, consider scanning devices used to access the domain for malware or unauthorized modifications.