prime-onion[.]shop

Analysis of prime-onion.shop indicates an active high‑risk phishing infrastructure. The domain was registered through NameSilo on February 21, 2026 and resolves to IP address 45.147.197.100, which is hosted in the Netherlands under the entity Podaon SIA. HTTP requests return a 200 status code and the site presents a valid Let’s Encrypt R12 TLS certificate, suggesting a functional web service. The page title retrieved is "Prime Market | Darknet Onions | Instant Link Verification," which aligns with the generic_phishing classification but provides no further detail on the targeted brand or payload. MX records are configured to point to the domain itself, a common tactic to increase deliverability of malicious emails. VirusTotal scans have flagged the domain by 2 of 91 security vendors, and the site is currently listed on one public blocklist, blocked by PhishDestroy, and receives a Gridinsoft trust score of 0/100, reinforcing its malicious nature. No additional intelligence on the site’s content or credential‑harvesting mechanisms is available at this time. Defenders should add prime-onion.shop to network and email filtering blocklists, monitor DNS queries for the associated IP, and consider sinkholing the domain to disrupt further activity. Ongoing observation is recommended to capture any changes in hosting, certificate renewal, or content that could refine the threat profile.