perpetualadvis[.]com

The domain perpetualadvis.com is currently flagged as an active generic phishing site designed to mimic Cloudflare security verification pages. Analysis indicates this infrastructure is engineered to harvest user credentials or sensitive information under the pretense of a required authentication step. No legitimate brand affiliation has been identified, though the page title explicitly references Cloudflare, suggesting an attempt to exploit trust in security validation processes. Infrastructure analysis reveals the domain was registered on April 18, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.58.144, which is part of a network range commonly utilized for content delivery and proxy services. Detection metrics show 4 of 95 security vendors on VirusTotal have flagged this domain, while it appears on one security blocklist. The domain employs Cloudflare Browser Insights and HTTP/3, likely to evade detection and enhance perceived legitimacy. The page title, Attention Required! | Cloudflare, reinforces the social engineering tactic by simulating an urgent security prompt. Current status remains active, with elevated risk due to low detection rates and the use of proxy services to obscure origin infrastructure. Users encountering this domain are advised to avoid interaction, particularly any requests for credentials or personal data. Network administrators should implement blocklisting for the domain and its associated IP address. Security teams are encouraged to monitor for similar domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED or resolving to the same network range, as these may indicate related phishing campaigns. Verification of any unexpected security prompts through official channels is strongly recommended to mitigate credential compromise risks.