viagra-buying[.]com

Analysis of the domain viagra-buying.com indicates active brand impersonation targeting Grab, a Southeast Asian technology company. Registered on April 21, 2026, through Fewmoretaps OU (operating as Trustname.com), the domain currently resolves to 3.71.180.249, an IP address located in Germany within AWS EC2's eu-central-1 region. Infrastructure analysis reveals the use of nameservers ares.trustname.com and zeus.trustname.com, and an SSL certificate issued by Let's Encrypt (R12). The domain returns an HTTP 301 redirect status, though the destination remains unconfirmed. The page title 'Just a moment...' suggests the presence of a cloud-based security challenge or interstitial page, which may obscure the final phishing content from automated scans. Security vendors have flagged the domain, with 7 of 91 engines on VirusTotal detecting malicious activity. It appears on at least one security blocklist and has been documented in a threat intelligence pulse on AlienVault OTX. The domain's trust score from Gridinsoft is 0/100, further supporting its classification as high-risk. While the exact phishing kit or lure remains unconfirmed, the infrastructure aligns with known brand impersonation tactics. Defenders should treat this domain as active and malicious. Network-level blocking of 3.71.180.249 and the domain itself is recommended. Monitoring for related domains registered through the same registrar or hosted on Trustname.com nameservers may help identify additional threats. Given the use of AWS infrastructure, defenders should also check for other malicious domains resolving to the same IP range.