user[.]primesignalgate[.]com

PhishDestroy identifies user.primesignalgate.com as an active credential harvesting portal masquerading as a legitimate PrimeSignal gateway for high-risk users. This domain was flagged under a generic phishing classification and is currently under investigation by threat intelligence teams. The page mimics PrimeSignal’s login interface, tricking victims into submitting corporate email credentials into a counterfeit form hosted at this TLS-enabled endpoint.

Evidence supporting this advisory includes VirusTotal’s 5/95 detection ratio, a domain creation date of April 08, 2026, registration via PDR Ltd. PublicDomainRegistry, and resolution to IP 172.67.159.190. The presence of a Let’s Encrypt SSL certificate underscores the domain’s deceptive legitimacy. While currently unblocked in most commercial feeds, the domain’s recent registration and zero detections suggest a newly deployed operation that may expand rapidly across enterprise environments.

Users who visited this domain should immediately change any credentials entered, enable multi-factor authentication on all business-critical accounts, and scan internal systems for lateral movement artifacts. Isolate affected endpoints and report the incident to the security operations center. Monitor for phishing emails referencing “PrimeSignal” or “signal gate” services and update blocklists with this IP and domain. Avoid restoring browser sessions without clearing cached data to prevent reinfection. This site exemplifies the growing trend of short-lived domains used in targeted credential harvesting campaigns.