canvprime[.]pro

The domain canvprime.pro was registered on June 13 2025 through Dynadopt LLC and currently resolves to the IP address 107.172.61.186, which is hosted in the United States under ASN 36352 (HostPapa). The site presents the page title "Canva Prime Company – Home" and uses a publicly‑trusted Let’s Encrypt R13 certificate, returning HTTP 200 for the root request. Reputation services rate the domain extremely low: Scamadviser scores 1/100, Gridinsoft 0/100, and three of ninety‑five VirusTotal scanners flag it as malicious. The domain appears on at least one public blocklist and is actively blocked by PhishDestroy. The listed scam type is "cryptocurrency," and the brand target is indicated as "across," suggesting a broad impersonation campaign rather than a single brand. Analysis indicates that the infrastructure is typical of low‑cost, rapidly‑deployed phishing or crypto‑drain campaigns, leveraging a reputable certificate to avoid simple TLS‑based filtering. The use of a generic page title that mimics a well‑known design tool (Canva) may be intended to lure users seeking design services, but no additional content has been examined. Defenders should add the IP address and domain to outbound web‑filter deny lists, monitor DNS queries for the domain, and consider sinkholing the name to disrupt future resolutions. Ongoing telemetry should be collected to confirm whether the site hosts malicious payloads or credential‑harvesting forms, as the current evidence is limited to infrastructure and reputation indicators.