puroletor[.]com-payrv[.]cc

Analysis of puroletor.com-payrv.cc indicates an active, high‑risk phishing operation. The domain was registered through Gname.com Pte. Ltd. on September 17, 2025 and resolves to the IP address 104.21.15.143. Independent telemetry shows the site is blocked by PhishDestroy and appears on a single security blocklist, confirming that defensive feeds have already flagged it. Google Safe Browsing classifies the domain as a social‑engineering threat, and VirusTotal reports that 13 of 91 scanning engines have identified malicious behavior associated with the host.

The threat type is listed as generic phishing, and the risk level is high, suggesting that the infrastructure is being used to harvest credentials or personal data. Concrete evidence is limited to these reputation signals; no page title, SSL details, or HTTP response codes are currently available, and the specific phishing lures or target brands have not been disclosed. Uncertainty remains around the exact payload delivered to victims and whether the domain is part of a larger cluster of related phishing sites.

Defenders should immediately add puroletor.com-payrv.cc to network blocklists, enforce DNS sinkholing, and monitor outbound connections to the resolved IP. Security teams are advised to update URL filtering policies, share the indicator with threat‑intelligence platforms, and continue probing the site for payload samples to enrich detection signatures. Continuous observation is recommended to detect any rapid changes in hosting or content that could affect mitigation efficacy.