buy-hydroxychloroquine[.]com

This domain, buy-hydroxychloroquine.com, is flagged as an active phishing site impersonating a pharmaceutical vendor. Registered on April 24, 2026, through Fewmoretaps OU operating under Trustname.com, the domain resolves to an IP address (3.71.180.249) hosted on AWS EC2 in Frankfurt, Germany. Infrastructure analysis reveals the use of nameservers ares.trustname.com and zeus.trustname.com, a pattern consistent with domains registered through the same provider. The site currently returns an HTTP 403 status, indicating access restrictions, though this does not preclude backend functionality or redirection to malicious endpoints. The domain appears in two AlienVault OTX threat intelligence pulses, suggesting prior identification by security researchers. It is also blocked by at least one security vendor and assigned a trust score of 0/100 by Gridinsoft, reflecting high-risk characteristics. While VirusTotal currently shows no detections (0/95 engines), this absence does not confirm legitimacy, as phishing domains often evade initial detection through obfuscation or delayed malicious activity. The SSL certificate, issued by Let's Encrypt (R12), is standard for both legitimate and malicious sites and provides no inherent indication of trustworthiness. Defenders should treat this domain as high-risk pending further investigation. The combination of pharmaceutical-themed branding, recent registration, and association with a known bulk registrar raises concerns about potential fraudulent sales or credential harvesting. Network-level blocking is recommended, particularly for organizations in healthcare or retail sectors where such lures are commonly exploited. Monitoring for changes in HTTP status or content delivery may provide additional indicators of malicious intent, as phishing campaigns frequently activate payloads after initial reconnaissance.