primexholdersvip[.]com

Analysis of primexholdersvip.com (registered 26 Feb 2025) shows the site is currently offline. The domain resolves to 198.23.190.194, an address owned by AS36352 HostPapa in the United States. The SSL certificate presented is identified as “R11”, indicating a potentially self‑signed or low‑trust certificate. Registration was performed via OwnRegistrar, Inc., and no additional privacy protection was noted. The page title retrieved before takedown reads “Prime X Holders Vip – Safe investment with Prime X Holders Vip”, which does not reference the impersonated brand but the infrastructure is linked to a Google impersonation campaign.

VirusTotal records indicate that 2 of 93 scanning engines flagged the domain, and the site appears on a single public blocklist. Independent reputation services assign very low scores: Gridinsoft reports 0 / 100 and Scamadviser 1 / 100, reinforcing the malicious assessment. The domain is also listed by PhishDestroy as blocked and is categorized as a “Tech Support Scam”. No Safe Browsing, OTX, or additional evidence links were supplied.

The combination of a recent registration date, low‑trust SSL, hosting on a shared provider, and multiple negative reputation signals suggests the domain was used to lure victims into a fraudulent tech‑support interaction masquerading as Google support. Because the site is offline, active collection of payloads is not possible, but the identified IP address and registrar details remain reusable for future campaigns. Defenders should add 198.23.190.194 to network blocklists, monitor OwnRegistrar, Inc. for new registrations resembling the pattern, and watch for similar page‑title phrasing. Continuous surveillance of the host provider’s address space and periodic re‑query of VirusTotal and other scanning services are recommended to detect re‑appearance of the infrastructure.