pfcreditunion[.]com

pfcreditunion.com is currently active and serves a page titled “Pfcreditunion- Your New Favorite Bank”. The site resolves to IP 163.61.188.7, which geolocates to the United States and is hosted by Hostinger UAB. DNS is managed by four LyteHosting nameservers. The domain uses a Let’s Encrypt R12 certificate, and its MX record points to the same host name, indicating a functional mail service that could be used for credential harvesting. The domain appears on one security blocklist and has been added to PhishDestroy’s blocklist. It is referenced in two AlienVault OTX pulses, and six of ninety‑one VirusTotal scanners have flagged it as malicious. These indicators collectively confirm that the infrastructure is being leveraged for phishing. No public analysis of the page content beyond the title is available, so the exact credential‑capture method remains unknown. Defenders should block the domain at network perimeter and DNS, monitor for outbound connections to 163.61.188.7, and consider adding the domain to internal blacklists. Continued threat‑intel feeds should be consulted for any updates on associated phishing kits or victim reports.