prtempur[.]site

The domain prtempur.site was registered on May 05, 2026 through NameCheap, Inc. It is delegated to the Cloudflare nameservers irma.ns.cloudflare.com and rodrigo.ns.cloudflare.com, and resolves to the IP address 188.114.97.3, which is hosted by Cloudflare, Inc. in Canada. The site presents an HTTP 403 response and serves a valid Let’s Encrypt certificate (E8), indicating that the infrastructure is deliberately configured to appear legitimate while restricting direct access to the underlying content.

Infrastructure analysis shows a trust score of 0 out of 100 from a widely used reputation engine, confirming the malicious posture of the host. The domain appears on a single security blocklist and is actively blocked by PhishDestroy, suggesting that at least one downstream defense has identified it as a threat vector. VirusTotal reports a single detection out of ninety‑five scanned security vendors, and AlienVault OTX lists the domain in one threat‑intel pulse, providing additional corroboration of its involvement in malicious campaigns.

The current risk rating is high and the status remains active, indicating that the phishing infrastructure is likely still operational. While the limited number of detections may reflect a recent deployment or low exposure, the combination of a fresh registration, low trust score, blocklist presence, and the use of reputable SSL infrastructure points to a purposeful attempt to evade casual scrutiny while delivering phishing content.

Defenders should block the domain and its associated IP at network perimeters, enforce DNS filtering to prevent resolution, and monitor for any traffic exhibiting the HTTP 403 pattern from the same IP range. Continuous re‑evaluation of the domain’s reputation across additional threat feeds is advised, as further detections may emerge as the campaign gains traction.