primecargoservice[.]enxlog[.]info

The domain www.primecargoservice.enxlog.info was registered on March 11, 2026 through OwnRegistrar, Inc. As of the report date 12 July 2026, it remains active and is classified as a high‑risk generic phishing site. The site resolves to the IPv4 address 109.176.207.222, which is allocated to AS214036 (Ultahost, Inc.) in the Netherlands. The HTTP response code returned was 200, indicating that the server is reachable and serving content.

DNS resolution is handled by the authoritative name servers ns1.meetabee.com and ns2.meetabee.com. The domain presents a valid TLS certificate issued by Let’s Encrypt with the R13 identifier, confirming that transport encryption is in place. Observed web technologies include Bootstrap, jQuery, CDNJS, Smartsupp live‑chat widget, LiteSpeed web server, Cloudflare edge services, and support for HTTP/3, suggesting a relatively modern hosting stack.

Threat intelligence sources have flagged the domain on a single security blocklist and it is currently blocked by the PhishDestroy mitigation service. VirusTotal analysis shows that 15 of 95 scanned security vendors raise detections against the domain, reflecting a modest but notable consensus of malicious behavior. The Gridinsoft trust score is 0 out of 100, reinforcing the assessment of a hostile payload. The site’s page title, “Prime Cargo Service | Courier,” aligns with the phishing classification and implies an attempt to exploit trust in logistics services.

Defenders should prioritize blocking outbound connections to 109.176.207.222 and adding www.primecargoservice.enxlog.info to DNS filtering policies. Continuous monitoring of the associated name servers and registrar may reveal further infrastructure changes. Given the active status and high risk rating, organizations handling sensitive credential data should enforce multi‑factor authentication and educate users about unsolicited courier‑related communications.