premuim[.]online

Analysis of the domain premuim.online indicates an active infrastructure supporting a generic phishing campaign. The site returns HTTP 200 and presents the page title “KAST – The global money app powered by stablecoins”, suggesting an attempt to lure victims interested in stablecoin services. DNS resolution points to the IP address 188.114.97.3, which is hosted by CloudFlare, Inc. in Canada. The domain was registered through NameCheap, Inc., and the authoritative name servers are dimitris.ns.cloudflare.com and khloe.ns.cloudflare.com. TLS is provided by a Let’s Encrypt certificate (identifier YE2), confirming the use of a publicly trusted certificate authority. The domain appears on three external blocklists and has been flagged in two AlienVault OTX pulses, indicating prior detection by threat‑intel sources. It is currently blocked by the PhishDestroy, MetaMask, and SEAL filtering solutions, demonstrating that several defensive products have incorporated it into their detection rules. The domain has been scanned by 91 antivirus vendors on VirusTotal, though no detections were reported at the time of scanning; this lack of detections does not imply safety. The overall evidence—active web service, legitimate‑looking TLS, registration details, and inclusion on multiple blocklists—supports a high‑risk classification. Defenders should continue to block the domain at network perimeter and endpoint layers, monitor DNS queries for the resolved IP, and consider adding the domain and its IP address to internal blacklists. Ongoing observation of any changes to the hosting infrastructure or certificate details is recommended.