perdison[.]de

This domain, perdison.de, is actively engaged in a credential harvesting campaign designed to mimic legitimate login portals. Analysis indicates the site presents a fraudulent interface prompting users to enter sensitive account credentials, which are then exfiltrated to attacker-controlled infrastructure. The threat is classified as a high-risk fake login scheme, targeting users through deceptive email and messaging vectors that impersonate trusted service providers. No specific brand impersonation has been confirmed, but the generic login form suggests broad applicability across multiple platforms. Infrastructure analysis reveals perdison.de resolves to the IP address 185.30.32.240, a host previously associated with malicious activity. The domain is registered through Namecheap, Inc., with a creation date of recent origin, though exact registration details remain partially obscured. VirusTotal detection metrics report 8 out of 95 security vendors flagging the domain as malicious, indicating moderate but growing consensus across detection engines. Additional blocklist aggregators show the domain listed in at least three independent threat intelligence feeds, reinforcing its classification as an active threat. Users who have visited perdison.de or entered credentials on the site should immediately revoke access to any accounts potentially exposed. It is recommended to change passwords using a secure, non-compromised device and enable multi-factor authentication where available. System scans using updated security tools should be conducted to detect any secondary payloads or persistent threats. Network-level monitoring for connections to 185.30.32.240 is advised, as continued communication with this IP may indicate ongoing compromise. No further interaction with the domain or its associated infrastructure should occur.