prem[.]li

The domain prem.li was registered on 22 February 2026 and currently resolves to the Cloudflare address 104.21.49.43, which is assigned to AS13335 in the United States. The site presents a page titled “PremiumLinks.co | Shorten, Track, Manage and Protect your URLs” and loads a stack of common web‑toolkit components including Bootstrap, SweetAlert2, jQuery, jsDelivr, Sendinblue, reCAPTCHA and Google Analytics. HSTS is enforced and the TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS connection despite the HTTP 526 status returned by the server, which signals a TLS handshake failure at the edge. The domain appears on one external blocklist and has been flagged by PhishDestroy.

AlienVault OTX references link the domain to fourteen threat‑intel pulses, reinforcing its association with malicious activity. Reputation scoring from Gridinsoft assigns a zero‑out‑of‑hundred trust rating, and VirusTotal reports eight of ninety‑five scanned security engines flagging the host as malicious. The infrastructure is fully hosted on Cloudflare, using the nameservers nova.ns.cloudflare.com and walt.ns.cloudflare.com, which complicates attribution of the underlying host.

The combination of a recent registration, low trust score, multiple vendor detections, and inclusion in OTX pulses suggests the domain is being leveraged for a generic phishing campaign, although the exact payload or targeted brand has not been disclosed in the available data. Defenders should consider adding prem.li to deny‑list policies at perimeter firewalls and DNS filtering services, enforce TLS inspection where possible, and monitor for any outbound traffic to the IP address 104.21.49.43. Continuous re‑evaluation is advised, as the site remains active and may evolve its tactics or payload delivery mechanisms.