# PhishDestroy domain threat record: primefincompany.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/primefincompany.com/
Machine-readable companion: https://phishdestroy.io/domain/primefincompany.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 07:30:17 UTC
- Last availability or vendor check: 2026-10-27 23:04:13 UTC
- Stored record updated: 2026-10-27 23:24:22 UTC
- VirusTotal detections in the stored snapshot: 1/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 104.21.44.85
- Registrar in stored WHOIS data: TUCOWS.COM, CO.
- Registrar country in stored WHOIS data: KN
- Last stored HTTP status: 301
- Registration date in stored WHOIS data: 2026-06-25 06:19:06 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a1771f-ad67-71ea-b9b4-144768861b4b/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/primefincompany.com
- Certificate Transparency search: https://crt.sh/?q=%25.primefincompany.com
- Web Archive lookup: https://web.archive.org/web/*/https://primefincompany.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured screenshot taken on 2026-10-26 shows a dark German-language trading landing page headed with the message that your trading potential has been determined. It advertises a completely risk-free trading platform alongside claims of 95 percent success, more than 10 million euros funded, over 2,500 CFD instruments and 400,000 active customers. PhishDestroy listed the domain after VirusTotal flagged it as malicious while the domain was 122 days old, and it was first seen by PhishDestroy on 2026-10-26.

How the scam works
The page lures visitors with a guarantee of completely risk-free returns and inflated social-proof statistics, then routes them toward sign-up and deposit steps typical of fake broker schemes. As a category risk, such pages collect credentials or payment details under the appearance of a legitimate investment platform, and may later push victims toward larger deposits. No trading offer can honestly promise zero risk.

Evidence
The screenshot shows the risk-free offer and the inflated performance figures. On 2026-10-26 urlscan machine-learning engines scored the domain malicious at 90 while its overall verdict was not malicious, and a 2026-10-22 scan judged it clean. VirusTotal flagged the domain as malicious with a labelling vendor applying the malicious label, while Google Safe Browsing did not flag it, Spamhaus recorded no listing, external blocklists recorded 0 entries although PhishDestroy's internal blocklist flagged it, and OTX recorded 0 pulses. Requests funnelled from plain HTTP through a 307 redirect and the root through a 301 redirect to a German-language page; site inspection recorded 161 page requests, Google Fonts and Google Static trackers, a Cloudflare translation global, and 1 distinct script SHA256 hash (85310783cf14...) for campaign pivoting.

Infrastructure
Notable weaknesses first: no DKIM or DMARC recorded, DNSSEC unsigned, and HSTS not recorded. The domain was registered on 2026-06-25 through Tucows Domains Inc., served behind the Cloudflare WAF with Cloudflare nameservers. TLS 1.3, AES-256-GCM-SHA384, forward secrecy, ALPN h2; Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP present; SPF only; CAA present.

What to do
If you submitted credentials on primefincompany.com, change the password on the genuine service you used and enable 2FA, and contact your bank about any transactions you made. Do not send further money or reply to follow-up messages. Defenders should block primefincompany.com and keep the recorded script hash for pivoting.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a1771f-ad67-71ea-b9b4-144768861b4b/
Cloudflare Radar report: https://radar.cloudflare.com/scan/02880056-a3b6-4ff9-b32b-28b75c8c23af
URLQuery report: https://urlquery.net/report/6c9017ef-ea80-4770-948e-f4fc24547c7b
Stored capture screenshot: https://i.ibb.co/HDgrkjch/a52fa87d3859.png
Cloudflare Radar screenshot (2026-10-26T07:32:01Z): https://screenshots.phishdestroy.io/cf/02880056-a3b6-4ff9-b32b-28b75c8c23af.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/6c9017ef-ea80-4770-948e-f4fc24547c7b.png
URLScan screenshot (2026-10-22T02:00:12Z): https://screenshots.phishdestroy.io/us/01a16156-366e-7748-9179-6c6f7c58ab3a.png
URLScan capture report: https://urlscan.io/result/01a16156-366e-7748-9179-6c6f7c58ab3a/
URLScan screenshot (2026-10-26T07:37:10Z): https://screenshots.phishdestroy.io/us/01a17722-bdbd-76ae-93a4-5862024dcc80.png
URLScan capture report: https://urlscan.io/result/01a17722-bdbd-76ae-93a4-5862024dcc80/
VirusTotal report: https://www.virustotal.com/gui/domain/primefincompany.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=primefincompany.com
Archived copy: https://web.archive.org/web/20261026073054/https://primefincompany.com/de/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 20:20:27 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/HDgrkjch/a52fa87d3859.png
  Captured: 2026-10-26 07:32:58 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a1771f-ad67-71ea-b9b4-144768861b4b.png
  Captured: 2026-10-26 07:32:58 UTC
  Source report: https://urlscan.io/result/01a1771f-ad67-71ea-b9b4-144768861b4b/
- URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a16156-366e-7748-9179-6c6f7c58ab3a.png
  Captured: 2026-10-22 02:00:12 UTC
  Source report: https://urlscan.io/result/01a16156-366e-7748-9179-6c6f7c58ab3a/
  SHA-256: d9323d195401ec1b542ee89fc3ba3236a7d28a52e6400758a2dffda4f0a12744
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a17722-bdbd-76ae-93a4-5862024dcc80.png
  Captured: 2026-10-26 07:37:10 UTC
  Source report: https://urlscan.io/result/01a17722-bdbd-76ae-93a4-5862024dcc80/
  SHA-256: d9323d195401ec1b542ee89fc3ba3236a7d28a52e6400758a2dffda4f0a12744
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/02880056-a3b6-4ff9-b32b-28b75c8c23af.png
  Captured: 2026-10-26 07:32:01 UTC
  Source report: https://radar.cloudflare.com/scan/02880056-a3b6-4ff9-b32b-28b75c8c23af
  SHA-256: 4781fb53b5f3eb7b27d530c5199339ace21089433b7f40091fb6240c0eaa6680
- URLQuery: https://screenshots.phishdestroy.io/uq/6c9017ef-ea80-4770-948e-f4fc24547c7b.png
  Source report: https://urlquery.net/report/6c9017ef-ea80-4770-948e-f4fc24547c7b
  SHA-256: db15cd0e59cd3428377de557f48a4a72dd06aae3019c449d57c76ea8b3016fe8

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T07:36:32Z",
        "uuid": "01a1771f-ad67-71ea-b9b4-144768861b4b",
        "scanned_at": "2026-10-26T07:32:19Z",
        "final_url": "https://primefincompany.com/",
        "status": 403,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://primefincompany.com/",
                "from": "http://primefincompany.com/",
                "status": 307
            }
        ],
        "ip": "172.67.198.23",
        "ips": [
            "172.67.198.23"
        ],
        "asns": [
            "13335"
        ],
        "link_domains": [
            "www.cloudflare.com"
        ],
        "doc_hash": "7d7ae1c5410d5865a21f82da58154e40ab6bc3e056e1f3379572fe47ada39f0d",
        "script_hashes": [
            "85310783cf146e03a2178c2faaccb5e7262a9e7b0d7edde9916871ddea688287"
        ],
        "globals": [
            "_cf_translation"
        ],
        "cookies": [
            "cf_clearance"
        ],
        "tls": {
            "san": [
                "primefincompany.com",
                "*.primefincompany.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "primefincompany.com",
            "protocol": "QUIC",
            "valid_to": "2027-01-19T13:13:07Z",
            "valid_from": "2026-10-21T12:14:26Z"
        },
        "domain_age_days": 122,
        "apex_age_days": 122,
        "tls_age_days": 4,
        "tls_valid_days": 90,
        "requests": 7,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 90,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8",
            "x-frame-options": "SAMEORIGIN",
            "referrer-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T07:36:34Z",
        "uuid": "02880056-a3b6-4ff9-b32b-28b75c8c23af",
        "scanned_at": "2026-10-26T07:32:01Z",
        "final_url": "https://primefincompany.com/de/",
        "status": 200,
        "redirected": "same-domain",
        "history": [
            {
                "url": "https://primefincompany.com/",
                "status": 301
            },
            {
                "url": "https://primefincompany.com/de/",
                "status": 200
            }
        ],
        "dom_hash": "c119e5c9e1d665c90c3c1e4d59c583fa9e6ac88597a42eb27ecb2b76f980dc5b",
        "doc_hash": "1f4aa90702d7e05facbdd8db04536d66da908c8fad06b2eb98c924fba3b1ef13",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "primefincompany.com",
                "type": "A",
                "value": "104.21.44.85"
            },
            {
                "name": "primefincompany.com",
                "type": "A",
                "value": "172.67.198.23"
            },
            {
                "name": "primefincompany.com",
                "type": "AAAA",
                "value": "2606:4700:3033::ac43:c617"
            },
            {
                "name": "primefincompany.com",
                "type": "AAAA",
                "value": "2606:4700:3037::6815:2c55"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.44.85",
        "whois": {
            "registrar": "Tucows Domains Inc.",
            "created": "2026-06-25T08:19:06Z",
            "updated": "2026-06-25T08:19:29Z",
            "expires": "2027-06-25T08:19:06Z",
            "nameservers": [
                "hunts.ns.cloudflare.com",
                "rafe.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T07:31:53Z",
        "analysis_at": "2026-10-25T10:37:43Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 1,
            "suspicious": 0,
            "undetected": 39
        },
        "detections": {
            "desenmascara.me": "malicious"
        },
        "reputation": 0,
        "registrar": "Tucows Domains Inc.",
        "created": "2026-06-25T08:19:06Z",
        "expires": "2027-06-25T08:19:06Z",
        "updated": "2026-06-25T08:19:29Z",
        "first_seen": "2026-06-25T09:06:44Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.44.85"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "hunts.ns.cloudflare.com"
            },
            {
                "ttl": 600,
                "type": "TXT",
                "value": "zoho-verification=zb47653190.zmverify.zoho.eu"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.198.23"
            },
            {
                "ttl": 600,
                "type": "TXT",
                "value": "v=spf1 include:zohomail.eu ~all"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "hunts.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::6815:2c55"
            },
            {
                "ttl": 600,
                "type": "MX",
                "value": "mx.zoho.eu",
                "priority": 10
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "rafe.ns.cloudflare.com"
            },
            {
                "ttl": 600,
                "type": "MX",
                "value": "mx3.zoho.eu",
                "priority": 50
            },
            {
                "ttl": 600,
                "type": "MX",
                "value": "mx2.zoho.eu",
                "priority": 20
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::ac43:c617"
            }
        ],
        "dns_at": "2026-10-25T10:42:58Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "primefincompany.com",
                "*.primefincompany.com"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "24c4753364286f1f131b735566ae2679",
            "sha256": "4c9961cb7a056ce49892db08123754c5a0017917f51582e7615546d7c6e464a7",
            "subject": "primefincompany.com",
            "valid_to": "2027-01-19T13:13:07Z",
            "valid_from": "2026-10-21T12:14:26Z"
        },
        "whois": {
            "registrar": "Tucows Domains Inc.",
            "registrar_iana_id": "69",
            "registrar_url": "http://www.tucows.com",
            "created": "2026-06-25T08:19:06Z",
            "updated": "2026-06-25T08:19:29Z",
            "expires": "2027-06-25T08:19:06Z",
            "status": [
                "clientTransferProhibited",
                "clientUpdateProhibited"
            ],
            "nameservers": [
                "hunts.ns.cloudflare.com",
                "rafe.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited",
                "client update prohibited"
            ],
            "events": {
                "last changed": "2026-06-25T08:20:23Z",
                "registration": "2026-06-25T08:19:06Z",
                "registrar expiration": "2027-06-25T08:19:06Z",
                "last update of RDAP database": "2026-06-25T08:20:23Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T07:32:57Z",
        "mail_config": {
            "mx": [
                "mx.zoho.eu",
                "mx2.zoho.eu",
                "mx3.zoho.eu"
            ],
            "spf": "v=spf1 include:zohomail.eu ~all",
            "providers": [
                "Zoho Mail"
            ],
            "spf_lookups": 2
        },
        "caa_records": {
            "domain": "primefincompany.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "robots_txt": {
            "agents": [
                "*",
                "Amazonbot",
                "Applebot-Extended",
                "Bytespider",
                "CCBot"
            ],
            "present": true
        },
        "trackers": {
            "requests": 161,
            "trackers": [
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                }
            ]
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.32.216",
                    "host": "rafe.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.35.46",
                    "host": "hunts.ns.cloudflare.com"
                }
            ],
            "zone": "primefincompany.com"
        },
        "location": {
            "ip": "2606:4700:3037::6815:2c55",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "primefincompany.com"
        },
        "dns": {
            "A": [
                "104.21.44.85",
                "172.67.198.23"
            ],
            "MX": [
                "{\"exchange\": \"mx3.zoho.eu\", \"priority\": 50}",
                "{\"exchange\": \"mx2.zoho.eu\", \"priority\": 20}",
                "{\"exchange\": \"mx.zoho.eu\", \"priority\": 10}"
            ],
            "NS": [
                "hunts.ns.cloudflare.com",
                "rafe.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"hunts.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418341695, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "TXT": [
                "zoho-verification=zb47653190.zmverify.zoho.eu",
                "v=spf1 include:zohomail.eu ~all"
            ],
            "AAAA": [
                "2606:4700:3033::ac43:c617",
                "2606:4700:3037::6815:2c55"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3037::6815:2c55",
            "family": 6
        },
        "subdomains": {
            "count": 4,
            "subdomains": [
                "api.primefincompany.com",
                "inv.primefincompany.com",
                "socket.primefincompany.com",
                "www.primefincompany.com"
            ]
        },
        "whois": {
            "registrar": "Tucows Domains Inc.",
            "created": "2026-06-25T08:19:06Z",
            "updated": "2026-06-25T08:19:29Z",
            "expires": "2027-06-25T08:19:06Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp",
                "clientUpdateProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "hunts.ns.cloudflare.com",
                "rafe.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=UTF-8",
                "content-security-policy": "default-src 'none'; script-src 'nonce-pPj3g4Lw0O991e5kxyGeCM' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenge",
                "x-frame-options": "SAMEORIGIN",
                "x-content-type-options": "nosniff",
                "referrer-policy": "same-origin",
                "permissions-policy": "accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=*",
                "cross-origin-opener-policy": "same-origin",
                "cross-origin-resource-policy": "same-origin",
                "cross-origin-embedder-policy": "require-corp"
            }
        }
    }
}
```