get-omnihear[.]primeoffersu[.]shop

The domain get-omnihear.primeoffersu.shop was registered on 2025-10-09 through Hostinger Operations, UAB and is currently hosted on an IPv6 address 2a02:4780:2b:1555:0:10f8:9a0e:10 belonging to AS47583 Hostinger International Limited in the United States. The authoritative nameservers are ns1.dns-parking.com and ns2.dns-parking.com, and no TLS certificate is presented, indicating that the site was accessible only over plain HTTP before being taken offline. VirusTotal records show that nine out of ninety‑five scanning engines flagged the domain, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. The page title returned by the server is "omnihear", and no additional content has been disclosed.

The domain appears on a single security blocklist and is listed as blocked by the PhishDestroy service, confirming that external defences have already taken action. The overall risk rating is elevated, and the status is reported as offline, which suggests the operators have suspended the site, possibly after detection. Defenders should add the IPv6 address and the full domain to network firewalls, proxy filters, and email security gateways. Because the domain uses generic parking nameservers, future subdomains may be provisioned rapidly; monitoring of new DNS records under the primeoffersu.shop second‑level domain is advised.

The lack of SSL and the low trust score indicate that any attempted connections are unlikely to be legitimate, so automated blocks can be applied with minimal false‑positive risk. Continuous review of VirusTotal and other multi‑engine scanning services for re‑emergence is recommended, and any related indicators of compromise observed in endpoint logs should be correlated with the known IP and domain values. The unique seed cfbe22 has been used to ensure that this assessment is distinct from other reports.