h5[.]primex500[.]com

This domain, h5.primex500.com, is identified as a crypto wallet drainer infrastructure component, designed to siphon digital assets from unsuspecting users through deceptive transaction prompts. Analysis indicates the absence of any legitimate brand association or service offering, with the sole purpose being the deployment of malicious scripts targeting cryptocurrency wallets. The domain exhibits characteristics typical of drainer kits, including the use of Let's Encrypt SSL certificates to mimic secure connections and the hosting of fake wallet interfaces or approval prompts to trick victims into signing malicious transactions. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 95.179.228.71, a host previously linked to multiple phishing campaigns. It was registered through Gname.com Pte. Ltd. on April 30, 2026, an unusually future-dated creation that may indicate an attempt to evade detection or correlation. VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious, while it appears on 3 independent security blocklists. The domain holds a Gridinsoft trust score of 0/100, reinforcing its classification as high-risk infrastructure. No legitimate references or benign categorizations were observed in public or private threat feeds. As of the latest verification, h5.primex500.com has been taken offline, likely in response to detection and blocking by multiple security providers. However, the associated infrastructure—including the IP address and registrar—remains active and may be repurposed for future malicious campaigns. Users who interacted with the domain prior to its takedown should immediately revoke any wallet approvals, transfer assets to a new wallet, and scan their devices for malware. Given the elevated risk profile, ongoing monitoring of related indicators is recommended to detect potential resurgence or lateral movement within the threat actor's operational infrastructure.