perle[.]network

Analysis of perle.network identifies a high-risk credential-phishing domain that was taken offline on July 24, 2026. The domain was registered on March 19, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolved to Cloudflare IP 188.114.97.3, located in Canada. No SSL certificate was present, increasing the likelihood of plaintext credential interception. Infrastructure analysis reveals Cloudflare nameservers (elsa.ns.cloudflare.com, kirk.ns.cloudflare.com) and detected technologies including jQuery, Google Hosted Libraries, Cloudflare Browser Insights, and HTTP/3, which are consistent with modern phishing kits designed to evade detection and accelerate page loads.

The domain appears on four security blocklists and is actively blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL. Twelve of 94 security vendors on VirusTotal flagged the domain as malicious, though the exact content and target brand remain unconfirmed due to the site being offline at the time of assessment. No evidence of a specific phishing kit or brand impersonation (e.g., financial, crypto, or retail) is present in the available data. Defenders should treat this domain as confirmed malicious based on blocklist inclusion and vendor detections.

Network-level blocks should be implemented for the IP 188.114.97.3 and associated Cloudflare infrastructure. SOC teams should review logs for connections to perle.network or the IP, particularly from March 19 to July 24, 2026, and investigate any credential submissions or redirects tied to this domain. Due to the lack of SSL and use of Cloudflare, defenders should prioritize plaintext traffic analysis and review Cloudflare-specific evasion techniques in recent phishing campaigns. Further forensic analysis is recommended if the domain resurfaces or related infrastructure is identified.