premium-asset[.]org

Analysis of premium-asset.org confirms its classification as an active phishing domain targeting institutional investors. Registered through TuringSign Inc. d/b/a Cosmotown, the domain resolves to IP address 163.61.188.7, geolocated to the United States under MIT's network infrastructure. The site presents itself with the page title 'Premium-asset - Innovative solutions for institutional investors,' indicating a likely attempt to impersonate legitimate financial service providers. Infrastructure analysis reveals the use of Let's Encrypt SSL certificate YR2, a common choice among threat actors due to its accessibility and free provisioning. The domain's nameservers (dns1.lytehosting.com through dns4.lytehosting.com) suggest hosting through LyteHosting, a provider frequently associated with malicious domains. At the time of this report, premium-asset.org is flagged by 8 of 91 security vendors on VirusTotal and appears on one security blocklist, with additional corroboration from two threat intelligence pulses in AlienVault OTX. The domain remains accessible, returning an HTTP 200 status code, which confirms its operational status. Defenders should note that premium-asset.org was blocked by PhishDestroy, a specialized anti-phishing service, further supporting its classification as malicious. The registrar, TuringSign Inc., has been linked to other phishing domains, though no direct attribution to a specific threat actor or campaign is currently available. The exact phishing kit or payload delivered by this domain has not been analyzed, and the targeted brand—if any—beyond the generic 'institutional investor' theme remains unconfirmed. Organizations are advised to block the domain and its associated IP (163.61.188.7) at the perimeter, monitor for related indicators of compromise, and alert users to the risk of credential harvesting or financial fraud associated with this infrastructure.