prime-nutrition1[.]world

Analysis of prime-nutrition1.world indicates a newly registered domain that is being used for a generic phishing campaign. The domain was created on July 22, 2026 and resolves to the IP address 188.114.96.3. Registration details list Fewmoretaps OU d/b/a Trustname.com as the registrar, and the authoritative nameservers are david.ns.cloudflare.com and rosemary.ns.cloudflare.com, indicating use of Cloudflare’s DNS service. VirusTotal reports that the domain has been scanned by 91 security vendors, none of which have raised a detection at the time of analysis; this absence of flags should not be interpreted as confirmation of safety.

The domain is currently blocked by the PhishDestroy service and appears on a single external security blocklist, suggesting that at least one threat‑intelligence feed has identified it as malicious. The site’s status is listed as active and the risk level is marked as under investigation. The lack of publicly available page metadata, such as title or SSL certificate details, limits the ability to assess the exact lure employed by the site. However, the rapid registration date, coupled with the use of a reputable DNS provider and the presence on a blocklist, aligns with typical infrastructure patterns observed in credential‑harvesting operations.

The IP address 188.114.96.3 resides in a hosting environment that is not currently associated with known malicious actors, but its recent assignment suggests possible abuse. Because the domain is still active, security teams should consider implementing sink‑hole routing for traffic destined to this host, enforce multi‑factor authentication for accounts that might be targeted, and educate users about unsolicited communications that reference the domain. Continuous threat‑intel feeds should be consulted for any emerging detection from additional vendors, and any future changes to the domain’s DNS records or hosting location should trigger a reassessment of its risk posture.