primecorecpt[.]org

This domain, primecorecpt.org, is flagged as a generic phishing site targeting users of PrimeCore Capitals, a financial services brand. Analysis indicates the site mimics legitimate investment platforms, likely designed to harvest login credentials, personal data, or financial information through deceptive forms. No specific drainer kit signatures were identified in the available telemetry, but the use of WordPress and PHP suggests a common phishing framework with backend data exfiltration capabilities. Infrastructure analysis reveals the domain was registered on March 19, 2026, through Dynadot Inc, resolving to IP address 163.61.188.2. VirusTotal reports 9 out of 95 security vendors flagging the domain as malicious, while Gridinsoft and Scamadviser both assign a trust score of 1/100. The domain appears on one security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued by Let's Encrypt, a common tactic to lend superficial legitimacy to phishing sites. Technologies detected include WordPress, MySQL, PHP, and third-party services such as YouTube, Trustpilot, and Smartsupp, which may be used to enhance the illusion of authenticity. As of the latest scan, primecorecpt.org has been taken offline, reducing immediate exposure risk. However, the domain remains registered and could be reactivated or repurposed. Users who interacted with the site should assume credential compromise and initiate password resets for any accounts accessed during the exposure window. Organizations are advised to monitor network logs for connections to 163.61.188.2 and the domain itself, as well as implement blocklist updates to prevent future access attempts. The elevated risk level persists due to the domain's registration status and historical malicious activity.