toinprimetrade[.]com

The domain toinprimetrade.com was registered on March 10, 2026 through OwnRegistrar, Inc. and resolves to the IP address 64.28.236.18, which is owned by AS395092 Shock Hosting LLC in the United States. Current monitoring shows the site is taken offline, but historical evidence indicates it was used for a generic phishing campaign employing the Gambler Scam kit. The page title observed during scanning was "ToinPrimeTrade - Forex And Crypto Currency Trading Company," suggesting a pretended financial services façade. No SSL certificate was present, meaning communications were unencrypted.

The hosting environment reported LiteSpeed web server and a front‑end built with Bootstrap, jQuery, SweetAlert2, OWL Carousel, jsDelivr, JivoChat, and GetButton, consistent with typical phishing landing pages that blend interactive elements with social chat widgets. The domain appears on three security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its malicious classification. VirusTotal scans recorded 11 detections out of 95 security vendors, providing additional corroboration of malicious intent. Nameservers ns1.cyburgcloud.com and ns2.cyburgcloud.com are in use, a configuration commonly observed in disposable phishing infrastructure.

While the site is presently offline, the underlying IP and hosting provider remain active, and the observed toolkit could be redeployed under a new domain. Defenders should continue to block the IP 64.28.236.18, add to local deny lists, monitor for re‑registration of similar domains, and observe traffic for the identified JavaScript libraries that may be leveraged in future campaigns. Further analysis of any revived content should focus on the Gambler Scam kit signatures and the specific front‑end components noted above.