primevest[.]ltd

Analysis indicates that the domain primevest.ltd was registered on 21 February 2026 through Hostinger Operations UAB and is hosted on a Hostinger International Limited network (ASN 47583) located in the Netherlands. The domain resolves to 77.37.52.44 and uses generic parking name servers ns1.dns-parking.com and ns2.dns-parking.com. No TLS certificate is present, implying that any communication would occur over plain HTTP. The site is currently offline, but historical observations recorded the page title "1 new message", suggesting a minimal landing page typical of credential‑capture or notification‑spam vectors.

Threat intelligence classifies the domain as a crypto‑scam that impersonates the Ethereum brand, aligning with the declared brand target "Ethereum". Detection services have flagged the domain: two of ninety‑three VirusTotal scanners raised alerts, it is listed on one public blocklist, and PhishDestroy has actively blocked it. The Gridinsoft trust score of 0/100 further corroborates its malicious intent. The elevated risk rating reflects the combination of brand impersonation, cryptocurrency focus, and low trust metrics.

Uncertainty remains regarding the specific payload or phishing kit employed, as no additional content analysis or sandbox execution data are available. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the IP address or associated name servers, and incorporate the indicator (primevest.ltd) into threat‑intel feeds. Ongoing observation of the hosting provider’s asset pool is advised, as compromised accounts on shared hosting platforms can be reused for future campaigns.