pelapriscila[.]com

PhishDestroy identifies an active credential-harvesting campaign hosted at the recently registered domain pelapriscila.com. This site masquerades as a legitimate login portal to steal user credentials, primarily targeting victims through unsolicited email links or social-engineering vectors. The domain was created on March 28, 2026—just days ago—indicating a fast-turnaround campaign designed to evade early detection. It resolves to IP address 172.67.213.30 and uses a valid Let’s Encrypt SSL certificate, lending superficial legitimacy to deceive cautious users. Despite aggressive scanning, VirusTotal currently shows 3 out of 95 antivirus engines detecting malicious content, underscoring the campaign’s stealth and the need for proactive user vigilance.

This domain was flagged by PhishDestroy as an active phishing site following domain registration through NICENIC INTERNATIONAL GROUP CO., LIMITED—a registrar frequently exploited in low-cost bulk campaigns due to lax identity verification. The domain’s youth (created March 28, 2026) and clean VirusTotal score (3/95) suggest a newly deployed infrastructure, likely optimized for short-lived operations before takedown. While not yet widely blocklisted, the presence of a valid SSL certificate and recent creation date serve as red flags for security-conscious users. The campaign’s rapid deployment model increases the risk of successful credential theft before automated defenses catch up.

Users who visited pelapriscila.com or entered any credentials should immediately reset passwords on all related accounts and enable two-factor authentication where available. Review account activity for unauthorized access and consider revoking any session tokens issued during the visit. If credentials were reused across multiple services, prioritize changing passwords on high-value accounts (email, banking, cloud storage) first. Report the domain to your organization’s security team or to PhishDestroy via the reporting portal to aid in faster global blocklisting. Avoid clicking links from unsolicited messages and verify sender domains before entering login credentials—especially for sites claiming to be financial or corporate portals.