azithromycin-buyzithromax[.]com

PhishDestroy identifies azithromycin-buyzithromax.com as a recently activated generic phishing domain targeting unsuspecting users seeking azithromycin medications. The site impersonates legitimate pharmacy storefronts to harvest payment card details and personal information under the guise of selling prescription antibiotics. No known brand-specific assets (logos, trademarks, or cloned checkout flows) are present, indicating a low-sophistication opportunistic campaign rather than a targeted brand impersonation.

This domain resolves to IP 3.71.180.249 and was registered on July 28, 2025 through Fewmoretaps OU d/b/a Trustname.com. The domain is currently secured with a Let's Encrypt SSL certificate, which does not indicate trustworthiness. VirusTotal analysis shows zero detections (3/95 engines), and the domain remains unlisted on Google Safe Browsing (GSB) and major blocklists as of time of writing. Its recent creation and lack of historical telemetry suggest it is still in early deployment.

The domain is currently active and under active investigation by PhishDestroy. Users are advised to block access at the network or endpoint level and report the domain via internal security channels or to external threat intelligence feeds. Given the absence of known drainer kits or advanced obfuscation, immediate containment is feasible; however, the lack of third-party detections implies a window of exposure. Organizations should monitor for related infrastructure and update firewall rules accordingly. Remaining risk is classified as 'under investigation' pending further behavioral analysis and sandbox detonation.