# PhishDestroy domain threat record: primordiumx.net Content language: English Canonical HTML report: https://phishdestroy.io/domain/primordiumx.net/ Machine-readable companion: https://phishdestroy.io/domain/primordiumx.net/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-26 09:57:25 UTC - Last availability or vendor check: 2026-10-28 11:03:48 UTC - Stored record updated: 2026-10-28 11:24:30 UTC - VirusTotal detections in the stored snapshot: 3/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 163.61.188.9 - Registrar in stored WHOIS data: TuringSign Inc. d/b/a Cosmotown - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2025-11-07 05:57:10 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a177a5-12fc-7278-b2b5-9cb3ad9655ee/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/primordiumx.net - Certificate Transparency search: https://crt.sh/?q=%25.primordiumx.net - Web Archive lookup: https://web.archive.org/web/*/https://primordiumx.net/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview The captured screenshot from 2026-10-26 shows a dark green landing page branded Primordium X with a gold logo, top navigation ending in a Get Started button, and a hero reading The Better Way to Trade & Invest. PhishDestroy classified primordiumx.net as an investment scam platform, first seen on 2026-10-26. How the scam works The page offered a Create Free Account button beneath a live cryptocurrency price ticker, enabling account signups that can harvest credentials and solicit deposits against promised trading and investment returns. Its Security Comes First panels claiming 256 bits SSL encryption and two-factor authentication by default are trust-building lures typical of this scheme. Evidence The screenshot also showed the tagline Trade Invest stock, and Bond, a claim of helping over 2 million customers, and an Our Certification heading. On 2026-10-26 the urlscan ML engine scored 98 malicious while its overall verdict remained non-malicious, and VirusTotal flagged the domain as malicious with Netcraft while Fortinet labelled it spam. Spamhaus listed the domain in its spam category, external blocklists recorded 0 listings with PhishDestroy's internal blocklist active, OTX held 3 pulses, Google Safe Browsing was not flagged, and no cross-site redirect was recorded in the capture. Site inspection found jQuery, Bootstrap, AOS, Google Translate, Google Tag Manager and Microsoft Clarity, with 3 distinct script SHA256 hashes recorded, the first beginning f7f6a5894f1d. Infrastructure primordiumx.net was registered on 2025-11-07 through TuringSign Inc. d/b/a Cosmotown, with hosting recorded to network NEW DHAKA HARDWARE in BD behind a LiteSpeed server running PHP 8.1.33. Weaknesses dominate: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP all absent; TLS 1.3 with AES-128-GCM, forward secrecy and ALPN h2; SPF, DKIM 2048 and DMARC all present; CAA present; DNSSEC unsigned. What to do If you created an account or submitted credentials, change that password everywhere you reused it, enable two-factor authentication, contact your financial provider about any transfers, and review wallet connections you made with the site. Defenders should block primordiumx.net and pivot on the recorded script hashes. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a177a5-12fc-7278-b2b5-9cb3ad9655ee/ Cloudflare Radar report: https://radar.cloudflare.com/scan/c7586f6c-37d1-4939-a284-83066347531d URLQuery report: https://urlquery.net/report/ed56e639-3cec-4abc-a854-84aec898f279 Stored capture screenshot: https://i.ibb.co/S4HXTPPq/e792bd9e2e53.png Cloudflare Radar screenshot (2026-10-26T09:57:43Z): https://screenshots.phishdestroy.io/cf/c7586f6c-37d1-4939-a284-83066347531d.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/ed56e639-3cec-4abc-a854-84aec898f279.png URLScan screenshot (2026-10-08T13:50:42Z): https://screenshots.phishdestroy.io/us/01a11bc7-b385-7056-95d4-38e9a6052da2.png URLScan capture report: https://urlscan.io/result/01a11bc7-b385-7056-95d4-38e9a6052da2/ URLScan screenshot (2026-10-26T09:55:50Z): https://screenshots.phishdestroy.io/us/01a177a3-1d5e-7506-8ddc-18b9a9533013.png URLScan capture report: https://urlscan.io/result/01a177a3-1d5e-7506-8ddc-18b9a9533013/ URLScan screenshot (2026-10-26T10:02:24Z): https://screenshots.phishdestroy.io/us/01a177a9-18e3-728c-a9b1-e7002cdf1e8a.png URLScan capture report: https://urlscan.io/result/01a177a9-18e3-728c-a9b1-e7002cdf1e8a/ VirusTotal report: https://www.virustotal.com/gui/domain/primordiumx.net Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=primordiumx.net Archived copy: https://web.archive.org/web/20261026095744/https://primordiumx.net/ Revoke token approvals: https://revoke.cash/ Report crypto fraud (Chainabuse): https://www.chainabuse.com/report Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-26 18:17:21 UTC ## Stored page captures - Primary capture: https://i.ibb.co/S4HXTPPq/e792bd9e2e53.png Captured: 2026-10-26 09:58:54 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a177a5-12fc-7278-b2b5-9cb3ad9655ee.png Captured: 2026-10-26 09:58:54 UTC Source report: https://urlscan.io/result/01a177a5-12fc-7278-b2b5-9cb3ad9655ee/ - URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a177a3-1d5e-7506-8ddc-18b9a9533013.png Captured: 2026-10-26 09:55:50 UTC Source report: https://urlscan.io/result/01a177a3-1d5e-7506-8ddc-18b9a9533013/ SHA-256: 0b682d8e4f053f2d13e610c8006eb9b508c98022d38675fc8073726cddd79a61 - URLScan · 2026-10-08: https://screenshots.phishdestroy.io/us/01a11bc7-b385-7056-95d4-38e9a6052da2.png Captured: 2026-10-08 13:50:42 UTC Source report: https://urlscan.io/result/01a11bc7-b385-7056-95d4-38e9a6052da2/ SHA-256: 002717e05c9e20bdb857914812c27c596678551a71e2da89dd91f9581a340aae - URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a177a9-18e3-728c-a9b1-e7002cdf1e8a.png Captured: 2026-10-26 10:02:24 UTC Source report: https://urlscan.io/result/01a177a9-18e3-728c-a9b1-e7002cdf1e8a/ SHA-256: 4dc448b182ab0ee69f98fb75e63a8dcf32c0813a047f6730734d9d95ae0ecd57 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/c7586f6c-37d1-4939-a284-83066347531d.png Captured: 2026-10-26 09:57:43 UTC Source report: https://radar.cloudflare.com/scan/c7586f6c-37d1-4939-a284-83066347531d SHA-256: a6476ede2f6c1a78b8d4db8ea58884178ea73da332d74200dcdc4dd1a775bd3b - URLQuery: https://screenshots.phishdestroy.io/uq/ed56e639-3cec-4abc-a854-84aec898f279.png Source report: https://urlquery.net/report/ed56e639-3cec-4abc-a854-84aec898f279 SHA-256: f57365d68edb282e275913fa81b5b3212d5f9aba3bcff3b115a0b107f808b0b0 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-26T10:28:26Z", "uuid": "01a177a5-12fc-7278-b2b5-9cb3ad9655ee", "scanned_at": "2026-10-26T09:57:56Z", "final_url": "https://primordiumx.net/", "status": 200, "ip": "163.61.188.9", "ptr": "s2.whitelabelclouds.com", "domains": [ "s2.coinmarketcap.com", "widget.coinlib.io", "www.gstatic.com", "unpkg.com", "www.googletagmanager.com", "translate-pa.googleapis.com", "fonts.gstatic.com", "translate.googleapis.com", "translate.google.com", "cdn.jsdelivr.net", "www.clarity.ms" ], "ips": [ "108.138.7.50", "142.251.110.97", "172.217.117.4", "142.251.14.94", "142.251.20.95", "142.251.13.94", "216.150.16.65", "192.178.183.101", "104.17.208.5", "104.18.1.22", "163.61.188.9" ], "asns": [ "16509", "15169", "13335", "153568" ], "countries": [ "US", "BD" ], "link_domains": [ "translate.google.com", "coinlib.io" ], "doc_hash": "0f9d52dbd0a32a5da99832640ce0213ac484c3969a855fb534aa2de1964f1602", "script_hashes": [ "f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d", "8d7089253dca29c9cd8d9deb7ec69b0a3d445f88f6a26478c719be1f90adcb01", "a53c43f834b32309b084ea9314df8307e9c78cee2202c6e07f216ae4ae5b704d" ], "globals": [ "uidEvent", "bootstrap", "$", "jQuery", "AOS", "googleTranslateElementInit", "changeLanguage", "_DumpException", "google", "default_tr", "_F_toggles_default_tr", "closure_lm_281465" ], "cookies": [ "XSRF-TOKEN", "primorddium_x_session" ], "tls": { "san": [ "*.primordiumx.net", "primordiumx.net" ], "cipher": "AES_128_GCM", "issuer": "YR2", "subject": "primordiumx.net", "protocol": "TLS 1.3", "valid_to": "2026-12-25T18:50:11Z", "valid_from": "2026-09-26T18:50:12Z" }, "domain_age_days": 353, "apex_age_days": 353, "tls_age_days": 29, "tls_valid_days": 89, "requests": 93, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 98, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "LiteSpeed", "content-type": "text/html; charset=UTF-8", "x-powered-by": "PHP/8.1.33" } }, "cf": { "v": 1, "fetched_at": "2026-10-26T09:58:07Z", "uuid": "c7586f6c-37d1-4939-a284-83066347531d", "scanned_at": "2026-10-26T09:57:43Z", "final_url": "https://primordiumx.net/", "status": 200, "history": [ { "url": "https://primordiumx.net/", "status": 200 } ], "dom_hash": "a14cc3de97243fd28bc433108bc67f3023593d20280069b22b50d60a84213d81", "doc_hash": "4a098b0bf1b391e89d3cf64665c919bc29af26d2607d294fb0d2faff94cd6e90", "url_risks": [ "Scam" ], "domain_risks": [ "Scam", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "primordiumx.net", "type": "A", "value": "163.61.188.9" } ], "dnssec_valid": false, "ip": "163.61.188.9", "whois": { "registrar": "TuringSign Inc. d/b/a Cosmotown", "created": "2025-11-07T06:57:10Z", "updated": "2025-11-07T06:57:10Z", "expires": "2026-11-07T06:57:10Z", "nameservers": [ "dns1.lytehosting.com", "dns2.lytehosting.com", "dns3.lytehosting.com", "dns4.lytehosting.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-26T10:28:15Z", "analysis_at": "2026-10-26T09:55:44Z", "stats": { "timeout": 0, "harmless": 54, "malicious": 1, "suspicious": 2, "undetected": 35 }, "detections": { "Fortinet": "spam", "Netcraft": "malicious", "alphaMountain.ai": "spam" }, "reputation": 0, "categories": { "alphaMountain.ai": "Spam (alphaMountain.ai)" }, "created": "2025-11-07T00:00:00Z", "updated": "2025-11-07T00:00:00Z", "first_seen": "2025-11-07T07:25:05Z", "dns": [ { "ttl": 14400, "type": "A", "value": "163.61.188.9" }, { "ttl": 21600, "type": "SOA", "rname": "root.beta.whitelabelclouds.com", "value": "ns1.cprapid.com" }, { "ttl": 21600, "type": "NS", "value": "ns2.cprapid.com" }, { "ttl": 14400, "type": "TXT", "value": "v=spf1 ip4:163.61.188.9 include:relay.serverfoundation.com include:srv.lytehosting.com +a +mx +ip4:163.61.188.222 ~all" }, { "ttl": 14400, "type": "MX", "value": "primordiumx.net", "priority": 0 }, { "ttl": 21600, "type": "NS", "value": "ns1.cprapid.com" } ], "dns_at": "2026-10-26T09:56:06Z", "jarm": "29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae", "cert": { "san": [ "*.primordiumx.net", "primordiumx.net" ], "issuer": "Let's Encrypt / YR2", "serial": "63ee8c871d45abbfee7ffe323efacb6cb4c", "sha256": "d9ccb53c0cc92420fd6ed7568e1e8c138eeea5981e1814aa9a9544e2ed2922bd", "subject": "primordiumx.net", "valid_to": "2026-12-25T18:50:11Z", "valid_from": "2026-09-26T18:50:12Z" }, "whois": [], "rdap": { "status": [ "client delete prohibited", "client renew prohibited", "client transfer prohibited", "client update prohibited" ], "events": { "last changed": "2025-11-07T06:57:10Z", "registration": "2025-11-07T06:57:10Z", "registrar expiration": "2026-11-07T06:57:10Z", "last update of RDAP database": "2026-10-22T23:12:58Z" }, "registrar": "Cosmotown, Inc.", "registrar_iana_id": "1509" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-26T09:58:26Z", "mail_config": { "mx": [ "primordiumx.net" ], "spf": "v=spf1 ip4:163.61.188.9 include:relay.serverfoundation.com include:srv.lytehosting.com +a +mx +ip4:163.61.188.222 ~all", "dkim": [ "default" ], "dmarc": true, "dkim_bits": 2048, "spf_lookups": 4 }, "caa_records": { "domain": "primordiumx.net" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-26T09:57:44Z", "first": "2026-10-26T09:57:44Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 10345 }, "robots_txt": { "agents": [ "*" ], "present": true }, "social_tags": { "title": "Primordium X | Welcome to Primordium X", "description": "We are online" }, "mixed_content": { "no_sri": [ "https://translate.google.com/translate_a/element.js", "https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js", "https://unpkg.com/aos@2.3.4/dist/aos.js" ], "third_party_scripts": 3 }, "status": { "up": true, "code": 200, "timings": { "dns": 71, "tls": 97, "wait": 1494, "connect": 103, "download": 95 }, "response_ms": 1860 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 21, 22, 25, 53, 80, 110, 143, 443, 587, 993, 995 ] }, "carbon": { "bytes": 34147, "co2_grams": 0.0012, "cleaner_than": 45 }, "dns_server": { "ns": [ { "host": "ns1.cprapid.com" }, { "host": "ns2.cprapid.com" } ], "zone": "primordiumx.net" }, "location": { "ip": "163.61.188.9", "asn": "153568", "org": "NEW DHAKA HARDWARE", "country": "BD" }, "ssl": { "issuer": "Let's Encrypt / YR2", "subject": "primordiumx.net" }, "dns": { "A": [ "163.61.188.9" ], "MX": [ "{\"exchange\": \"primordiumx.net\", \"priority\": 0}" ], "NS": [ "ns1.cprapid.com", "ns2.cprapid.com" ], "SOA": "{\"nsname\": \"ns1.cprapid.com\", \"hostmaster\": \"root.beta.whitelabelclouds.com\", \"serial\": 2026092601, \"refresh\": 3600, \"retry\": 1800, \"expire\": 1209600, \"minttl\": 86400}", "TXT": [ "v=spf1 ip4:163.61.188.9 include:relay.serverfoundation.com include:srv.lytehosting.com +a +mx +ip4:163.61.188.222 ~all" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "163.61.188.9", "family": 4 }, "redirects": { "chain": [ "https://primordiumx.net" ] }, "linked_pages": { "internal_count": 8 }, "whois": { "registrar": "TuringSign Inc. d/b/a Cosmotown", "created": "2025-11-07T06:57:10Z", "updated": "2025-11-07T06:57:10Z", "expires": "2026-11-07T06:57:10Z", "status": [ "clientDeleteProhibited https://icann.org/epp", "clientRenewProhibited https://icann.org/epp", "clientTransferProhibited https://icann.org/epp", "clientUpdateProhibited https://icann.org/epp" ], "nameservers": [ "dns1.lytehosting.com", "dns2.lytehosting.com", "dns3.lytehosting.com", "dns4.lytehosting.com" ] }, "headers": { "headers": { "server": "LiteSpeed", "content-type": "text/html; charset=UTF-8", "x-powered-by": "PHP/8.1.33" } } } } ```