city-premiertrust[.]com

The domain city-premiertrust.com was registered on 2024-10-03 through Dynadot LLC and is currently active. It is identified as a brand‑impersonation campaign targeting Google, with the page title “Welcome to | city-premiertrust.com” indicating a generic landing page. The host has been listed as high‑risk by multiple reputation services.

Infrastructure analysis shows the domain resolves to the IPv4 address 192.99.81.101, hosted in Canada under ASN 16276 (OVH SAS). Authoritative name servers are ns5.ddoscure.com and ns6.ddoscure.com. The web server presents an Nginx stack secured by a Let's Encrypt R13 certificate and enforces HTTP Strict Transport Security. Front‑end libraries detected include jQuery and SweetAlert.

Reputation signals reinforce the malicious classification. Scamadviser assigns a trust score of 16 / 100, while Gridinsoft rates the site at 0 / 100. The domain appears on a security blocklist managed by PhishDestroy and is flagged by 11 of 95 security vendors on VirusTotal. The HTTP response returns status 200, confirming the site is actively serving content.

Current intelligence does not include a detailed content analysis of the landing page, so the precise phishing mechanism—such as credential collection forms or malicious redirects—remains unverified. No malware hashes or payloads have been publicly released, and the presence of only generic web technologies limits attribution to a specific phishing kit.

Defenders should provisionally block city-premiertrust.com at the DNS and proxy layers, and add the associated IP address 192.99.81.101 to network‑level deny lists. Continuous monitoring of DNS queries for the listed name servers is advised, as well as periodic rescanning with updated threat intel feeds to capture any evolution of the campaign. Logging of TLS handshakes to the Let's Encrypt certificate can aid in detecting potential reuse of the infrastructure.