purlotor[.]com-payrwm[.]vip

This domain, purlotor.com-payrwm.vip, is flagged as a generic phishing site designed to harvest PayPal login credentials. Analysis indicates the infrastructure mimics legitimate payment portals, likely employing a credential-harvesting kit with minimal obfuscation. No direct association with known drainer kits has been confirmed, but the domain structure and naming convention suggest an intent to deceive users into entering sensitive financial information. Infrastructure analysis reveals the following technical indicators: the domain was registered through Gname.com Pte. Ltd. and resolves to IP address 104.21.61.138. It was created on June 12, 2026, and has been flagged by 13 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and uses an SSL certificate issued by Google Trust Services, which may lend a false sense of legitimacy. No Google Safe Browsing (GSB) flags were recorded at the time of analysis, though this does not preclude prior or future detections. The domain is currently offline, likely due to takedown actions or voluntary suspension by the registrar. Despite its inactive status, residual risk remains for users who may have interacted with the site prior to its removal. Organizations are advised to update blocklists with the domain and associated IP, monitor for credential reuse attempts, and conduct retrospective log analysis for connections to 104.21.61.138. Users should be alerted to verify payment portal URLs directly through official sources and enable multi-factor authentication on financial accounts to mitigate credential theft risks.