mexicanpharmacyshops[.]com

This domain, mexicanpharmacyshops.com, is currently classified as a generic phishing site with a high risk rating. The domain was registered on 21 April 2026 through Fewmoretaps OU d/b/a Trustname.com and resolves to the IPv4 address 3.71.180.249, which belongs to an Amazon Web Services EC2 instance in the eu‑central‑1 region (Germany). The authoritative nameservers ares.trustname.com and zeus.trustname.com are consistent with the registrar information. HTTP requests return a 403 status code and the page title observed is “DDoS‑Guard”. The site is listed on one security blocklist and is actively blocked by PhishDestroy. It appears in a single AlienVault OTX pulse and has a Gridinsoft trust score of 0 / 100. The SSL certificate is issued by Let’s Encrypt (R12). VirusTotal analysis shows that four of ninety‑one scanning engines have flagged the domain as malicious. The available data confirms that the infrastructure is actively used for phishing, but the specific payload, target brand, or compromised credentials have not been publicly disclosed. Defenders should add the domain and its IP address to blocklists, monitor DNS queries for the mentioned nameservers, and consider network‑level filtering for traffic to the AWS region. Continued observation is advised to detect any escalation or additional malicious content.