springprimec[.]org

Analysis as of July 25 2026 indicates that the domain springprimec.org was registered on March 11 2026 through PDR Ltd operating as PublicDomainRegistry.com. The site presented the page title “Spring Primec Bank”, suggesting an attempt to impersonate a financial institution. No TLS certificate was observed, meaning the site operated over plain HTTP. DNS resolution points to the IP address 206.206.125.111, which belongs to AS212238 Datacamp Limited and is geolocated in Great Britain. The domain’s authoritative name servers are dns1.bigrock.in through dns4.bigrock.in, indicating hosting services provided by BigRock.

Technical fingerprints show the use of Apache HTTP Server together with front‑end libraries Bootstrap, jQuery, Popper and OWL Carousel. VirusTotal scanned the site once and recorded a single positive from 95 security vendors, confirming that at least one scanner identified malicious behavior. The domain is listed on one public blocklist and has been actively blocked by the PhishDestroy mitigation service. Current HTTP probing reports the site as taken offline, which limits immediate credential harvesting but leaves the infrastructure reusable for future campaigns.

Defenders should continue to block the domain and its associated IP, add the domain to internal URL filtering and IDS signatures, and monitor the BigRock name‑server range for similar newly created domains. Ongoing observation of the AS212238 network for repeated use of the same IP or adjacent prefixes is recommended, as the host may be repurposed for additional phishing deployments. Because the site lacks SSL, any future reactivation would be vulnerable to network‑level interception, providing an additional vector for detection. Organizations should also review any login credentials submitted to “Spring Primec Bank” URLs for potential compromise.