psrms[.]is

On July 23, 2026 the domain psrms.is was observed as an offline site that had been used for brand impersonation targeting the brand “ton”. The domain was registered through Cloudflare on 17 December 2024 and is hosted on Cloudflare’s network (AS13335). DNS resolution points to IP address 188.114.96.3, which is associated with Cloudflare’s edge infrastructure in the United States. The authoritative name servers are alfred.ns.cloudflare.com and tegan.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service.

HTTPS is served with a certificate issued by Google Trust Services under the “WE1” designation, indicating a valid TLS chain, but the web server returned HTTP status 403, suggesting that content is not publicly accessible at the time of analysis. Security telemetry shows the domain appears on a single blocklist and has been actively blocked by PhishDestroy. Gridinsoft assigned a trust score of 1 out of 100, reflecting extreme suspicion. VirusTotal scans returned nine positive detections out of 95 vendors, reinforcing the malicious classification.

The page title retrieved before the site went offline was “¡PASAREMOS!”, which does not correspond to the impersonated brand and may have been used to lure victims. Given the combination of low trust score, multiple vendor detections, blocklist presence, and the brand‑impersonation label, defenders should continue to deny any network traffic to 188.114.96.3 associated with psrms.is, add the domain to URL filtering and email security policies, and monitor for any re‑registration or resurrection of the site. Because the site is currently offline, further content analysis is not possible; however, the existing indicators are sufficient to justify proactive blocking and alerting of users who might receive communications purporting to originate from the “ton” brand.