premcas[.]com

The domain premcas.com was observed resolving to the IP address 172.67.142.74, which belongs to Cloudflare, Inc. (ASN13335) and is geolocated in the United States. Technical fingerprinting shows the web server is powered by Nginx with the OpenResty module, and the TLS certificate is identified as WE1. Registration metadata indicates the domain was created on February 21, 2026 and is registered through PDR Ltd. d/b/a PublicDomainRegistry.com. Authoritative name servers listed for the zone are dns11.parkpage.foundationapi.com and dns10.parkpage.foundationapi.com.

The site’s HTML title reads "PREMCAS | Open the world of luck and rewards!", suggesting a lure based on promised rewards or gambling incentives. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy filtering service. VirusTotal analysis recorded two detections out of ninety‑three scanning engines, confirming that at least a minority of security vendors consider the domain malicious. As of the report date, the site is marked offline, indicating that the content has been taken down or the hosting has been suspended.

Defenders should continue to block the IP 172.67.142.74 and the domain premcas.com at the network perimeter and update any URL filtering rules to include the associated nameservers. Monitoring for re‑registration or new DNS records is advisable, as threat actors frequently recycle infrastructure. Because the page content beyond the title has not been publicly analysed, the precise phishing kit, targeted brand, or credential‑harvesting mechanisms remain uncertain. Organizations should treat the domain as a potential phishing vector and incorporate it into threat‑intel feeds and email gateway reputations until further intelligence clarifies its operational details.