havspuyq5ghavspuyq5ghavspuyq5ghavspuyq5g[.]wait[.]prime-tex[.]com

The domain havspuyq5ghavspuyq5ghavspuyq5ghavspuyq5g.wait.prime-tex.com was registered on May 15, 2026 through eNom, LLC and is currently taken offline. Infrastructure analysis shows the domain resolved to IP address 20.106.18.139, a Microsoft Azure Cloud node in the centralus region of the United States. The host presented an HTTP response with the page title "Index of /" and served a Let's Encrypt R12 certificate, indicating TLS was active at the time of observation. Reputation services have assigned the domain a zero‑score trust rating (0/100) via Gridinsoft, and three independent blocklists have listed the domain.

Additional defensive products—PhishDestroy, MetaMask, and SEAL—have explicitly blocked the domain, while Google Safe Browsing classifies it as a social engineering threat. VirusTotal analysis recorded 11 detections out of 92 scanned engines, reinforcing the malicious assessment. Nameserver configuration points to four A2Hosting name servers (ns1‑ns4.a2hosting.com). The combination of low trust score, multi‑vendor blocklisting, and positive VirusTotal detections suggests a high‑risk generic phishing campaign.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanism, as the site content beyond the directory listing has not been captured. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration attempts, and consider adding the associated IP address to threat intel feeds. Ongoing surveillance of Azure host activity and periodic re‑scans of the domain, should it reappear, are recommended to maintain situational awareness.