craftprimetrade[.]com

Analysis as of July 25, 2026 indicates that the domain craftprimetrade.com was registered on March 10, 2026 through OwnRegistrar, Inc. The authoritative name servers listed are ns1.zunxoo.com and ns2.zunxoo.com, with a placeholder “null” entry. DNS resolution points to the IPv4 address 158.220.124.22, which is announced by AS51167 belonging to Contabo GmbH and geolocated to France. The web server identified on the host runs Apache HTTP Server on a UNIX platform, with PHP and OpenSSL components detected, but no TLS certificate was presented, meaning the site operated without HTTPS. The page title returned by the HTTP response is “craftprimetrade.com/”. Multiple security products have taken action against the host: PhishDestroy, MetaMask, and SEAL have listed it as blocked, and Google Safe Browsing categorises the URL as social engineering.

VirusTotal scans show that 12 of 95 scanning engines flagged the domain, confirming a malicious reputation. The domain appears on three external blocklists, reinforcing the consensus that it was used for phishing. Current monitoring shows the site has been taken offline, which may be a temporary takedown or a deliberate removal by the operators. Uncertainty remains regarding the exact content that was served before the shutdown, as no payload or credential‑capture page has been captured in the available data. The lack of an SSL certificate suggests that any credential collection would have occurred over clear‑text HTTP, but the specific phishing lure or targeted brand cannot be confirmed from the page title alone.

No evidence of additional infrastructure such as command‑and‑control servers, malware drops, or secondary domains has been observed. Defenders should continue to block craftprimetrade.com at perimeter filters and DNS resolvers, ensure that any outbound connections to 158.220.124.22 are denied, and monitor for reuse of the same name servers or hosting provider in future campaigns.