prime2[.]cc

On July 25, 2026, analysis of the domain prime2.cc confirms that it is being used for brand impersonation targeting Binance users. The domain was registered on July 8, 2025 through Gname.com Pte. Ltd. and resolves to the Amazon Web Services IP address 13.233.35.10, which is assigned to ASN 16509 in India. No TLS certificate is presented, and HTTP requests return a 503 status code, indicating the site is currently unavailable. The page title returned by the server is "RIVER". VirusTotal reports that ten of ninety‑five scanned security vendors flag the domain, demonstrating a moderate detection consensus.

The site is listed on a single security blocklist and has been blocked by the PhishDestroy service. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. Nameservers a8.share-dns.com and b8.share-dns.net are associated with the shared DNS infrastructure commonly used by malicious actors. The domain’s current offline status limits immediate observation, and no SSL certificate or additional content analysis is available.

Defenders should continue to block prime2.cc at network perimeter and DNS layers, monitor for any resurrection of the site, and add the domain to internal threat intel feeds. Continued observation of the associated IP address and its ASN is advisable, as the same infrastructure may host other impersonation campaigns. The lack of a valid certificate and the low trust score suggest that any future activation will likely rely on unencrypted HTTP, making it easier to intercept and block. Organizations using Binance services should educate users about the risk of unsolicited communications referencing "RIVER" and verify URLs before credential entry.