prime-chain[.]net

Analysis indicates that prime-chain.net was registered on 12 April 2026 through TuringSign Inc. d/b/a Cosmotown and is hosted on IP 163.61.188.5, which resolves to a US location associated with MIT. The domain serves content over HTTPS using a Let’s Encrypt (R13) certificate and returns HTTP 200. DNS resolution is handled by four lytehosting.com name servers. Automated reputation checks assign a Gridinsoft trust score of 0 / 100 and the domain is listed on one public blocklist; PhishDestroy actively blocks it. VirusTotal reports that two of ninety‑four scanned engines flag the site, confirming a low‑level detection signal. The site runs a PHP stack with front‑end libraries Chart.js, Bootstrap, jQuery, OWL Carousel, Smartsupp, GetButton and is delivered via LiteSpeed. The page title is “www.prime-chain.net |”, and the observed scam type is classified as a “Fake Exchange”. Defenders should treat the domain as high‑risk. The combination of a recent registration, low trust scores, blocklist presence, and partial VirusTotal detections suggests active phishing activity oriented around a counterfeit exchange service. Network defenders should block outbound connections to 163.61.188.5 and add the domain to URL filtering policies. Email security appliances should deny messages containing links to prime-chain.net. Continuous monitoring of DNS queries for the associated lytehosting.com name servers is advised, as they may be reused for additional malicious domains. Because the site currently returns a valid TLS certificate, interception based on certificate pinning is not feasible; therefore, endpoint detection should rely on URL reputation and heuristic analysis of traffic to the identified IP range. Further investigation is required to confirm the exact payload or credential‑harvesting mechanisms, as the page content has not been publicly analysed.