primeautosalesus[.]com

The domain primeautosalesus.com has been identified as a high-risk threat associated with credential theft. This domain presents itself with the page title 'Prime Auto Sales', suggesting possible brand impersonation to deceive users. Analysis indicates that it might be targeting users through phishing techniques, although no specific drainer kit has been identified in the investigation.

Technical indicators include a VirusTotal detection score of 2 out of 95, highlighting its recognition by a minority of security vendors. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 104.21.76.89. It was created on June 19, 2026, and has a very low trust score of 0/100 according to Gridinsoft. The site is currently blocked by PhishDestroy and appears on only one security blocklist. It also features in two threat intelligence pulses on AlienVault OTX.

The current status of the domain is active, posing a significant risk to potential victims. Response actions should include avoiding interaction with the domain, blocking the associated IP, and monitoring network traffic for related indicators. Remaining vigilant is essential due to its presence on the security blocklist and its active status. Users are advised to employ comprehensive security measures to mitigate the risk posed by this domain.