oakprimeinvestments[.]com

Analysis as of July 27, 2026 indicates that oakprimeinvestments.com is an active generic phishing domain with a high risk rating. The domain was registered on January 5, 2026 through TuringSign Inc. d/b/a Cosmotown and is delegated to the nameservers ns5.maskhosting.com and ns6.maskhosting.com, suggesting use of the MaskHosting hosting platform. DNS resolution points to the IPv4 address 5.182.208.207, which is the sole hosting endpoint observed for this campaign.

The domain is listed on one public security blocklist, specifically PhishDestroy, confirming that at least one anti‑phishing service has taken action against it. VirusTotal analysis shows that four of ninety‑one scanning engines have flagged the domain, providing additional independent corroboration of malicious intent. No further public intelligence such as SSL certificate details, page title, or brand targeting is currently available, leaving the precise phishing lure and content unverified.

The limited detection footprint—single blocklist entry and a modest number of vendor flags—does not diminish the high‑severity classification, given the recent creation date and active status. Defenders should immediately block oakprimeinvestments.com at DNS and proxy layers, add the domain to internal blocklists, and monitor outbound connections to the IP address 5.182.208.207 for potential data exfiltration attempts. Continuous re‑evaluation is recommended, as additional detections or content analysis may emerge, refining the threat profile and informing broader mitigation strategies.