primora[.]dat[.]ng

PhishDestroy identifies primora.dat.ng as a live generic phishing domain currently under investigation for hosting a crypto-draining campaign aimed at wallet credentials.

This domain resolves to 148.72.153.160 and leverages a Let’s Encrypt SSL certificate to appear legitimate; VirusTotal scanning has returned 0 detections out of 95 engines as of the current scan window (seed f7a98a). Registrar details, creation timestamp, and public blocklist inclusion have yet to be published; trust and reputation scores for the IP and domain remain unassigned, indicating a freshly stood-up infrastructure with little historical telemetry. The absence of detections suggests this campaign is still in its early stages and may evade legacy defenses.

Organizations and individual users should treat any prompt, email, or social-media lure pointing to primora.dat.ng with extreme caution. Because the infrastructure is newly observed and currently unflagged, static IOC lists will not provide reliable protection. PhishDestroy advises manual verification of every invitation or reward link before clicking; enable wallet-address allow-listing and hardware-wallet policies to block unexpected transfers. Reporting the domain to PhishDestroy and your security team will accelerate community threat-intel enrichment and may prevent subsequent victims from falling prey to the same scheme.