primeindexpro[.]com

The domain primeindexpro.com was observed hosting a generic phishing campaign and has since been taken offline. Registration data shows the domain was created on 4 May 2025 and is listed under the registrar Ultahost, Inc. The authoritative nameservers are ns27.asurahosting.com, ns28.asurahosting.com, ns27.my‑control‑panel.com, and ns28.my‑co, indicating hosting services provided by Asurahosting. DNS resolution points to the IPv4 address 198.251.89.220, which is geolocated to Luxembourg and attributed to a provider identified as FranTech Solutions. The web server employs LiteSpeed and advertises HTTP/3 support; a Smartsupp widget is also detected, suggesting the presence of a live‑chat component.

The site presented the page title “Primeindexpro” and was secured with a Let's Encrypt TLS certificate. VirusTotal scans recorded 5 positive detections out of 94 antivirus engines, and the domain appears on one public blocklist, where it was subsequently flagged by the PhishDestroy feed. These indicators collectively confirm that the infrastructure was used for phishing activity. No additional public intelligence, such as OTX references or Safe Browsing alerts, is currently available.

Because the site is offline, active threat mitigation is limited to updating defensive controls. Network defenders should add 198.251.89.220 to outbound and inbound block lists, enforce DNS filtering of the identified nameservers, and ensure that any corporate web filtering solutions ingest the PhishDestroy block entry. Monitoring for re‑registration of the domain or the emergence of similar infrastructure on the same hosting provider is recommended. Until further evidence emerges, the domain should be regarded as malicious and treated accordingly.