bestmedsonline24x7[.]com

This domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and points to IP 193.143.1.98 located in Russia under ASN 198953 (Proton66 OOO). The domain resolves to two expired name servers (expired-ns1.niceisp.com, expired-ns2.niceisp.com) and serves content over an unencrypted HTTP connection; no TLS certificate is present, meaning any data entered by a victim would be transmitted in clear text. A snapshot of the landing page shows the title "Cheap Online Pharmacy - bestmedsonline24x7.com", indicating an attempt to lure victims with low‑cost pharmaceutical offers. The server stack is identified as Ubuntu with Nginx, and the front‑end includes jQuery and jQuery Migrate, consistent with a typical low‑cost illicit commerce site. VirusTotal analysis recorded five detections out of ninety‑three scanning engines, and the domain appears on a single public blocklist, currently blocked by PhishDestroy.

Scamadviser assigns a trust score of 1 / 100, reinforcing the malicious intent. The site is presently offline, limiting immediate interaction but preserving the infrastructure for potential re‑deployment. Uncertainties remain regarding the exact payload delivered, credential‑harvesting mechanisms, and whether additional malicious hosts share the same IP range. The lack of a valid certificate also prevents browsers from establishing a trusted TLS channel, increasing the likelihood that any credential input will be exposed. Given the recent registration date, the infrastructure appears to be a short‑lived campaign, a pattern often observed in bulk‑phishing operations that rotate domains to evade reputation systems.

Defenders should continue to monitor the IP address for new activity, add the domain and its IP to outbound filtering rules, and ensure that email gateways block messages containing URLs from this domain. Security teams should also purge any cached DNS entries for this host to avoid accidental connections.