azithromycinzith[.]com

azithromycinzith.com is an active generic phishing site observed since its registration on 21 April 2026. The domain resolves to the IPv4 address 3.71.180.249, which belongs to an Amazon Web Services EC2 instance in the eu‑central‑1 region of Germany. HTTP requests return a 403 status code, indicating that the web server is configured to deny direct access, a pattern often used to hide malicious payloads behind redirects or client‑side scripts. The domain is served by two authoritative name servers, ares.trustname.com and zeus.trustname.com, both associated with the registrar Fewmoretaps OU operating under the Trade name Trustname.com. The TLS certificate presented is issued by Let's Encrypt (R12), showing a valid, auto‑renewed certificate without any extended validation. The certificate chain is correctly installed, which helps the site appear legitimate to naïve users. Threat intelligence shows the domain appears on a single security blocklist and is actively blocked by the PhishDestroy filtering service. AlienVault OTX lists the domain in one pulse, and the Gridinsoft trust scoring system assigns a score of 0 out of 100, indicating a high likelihood of malicious intent. VirusTotal currently reports 0 detections out of 95 scanners, which reflects the early stage of the campaign rather than a clean reputation. Defenders should treat azithromycinzith.com as a high‑risk indicator and add it to blocklists at network and email gateways. Monitoring DNS queries for the two Trustname.com name servers can provide early warning of related infrastructure reuse. Where possible, sinkholing the IP address or redirecting traffic to a safe landing page can disrupt the phishing flow. Organizations should also educate users about unexpected communications referencing azithromycin or related pharmaceuticals, as the domain name suggests a counterfeit medical‑related lure.