canadian24hrpharmacy[.]com

This domain, canadian24hrpharmacy.com, is flagged as an active phishing site targeting online pharmacy consumers. Registered on April 21, 2026, through Fewmoretaps OU d/b/a Trustname.com, the domain currently resolves to an IP address hosted on AWS EC2 in Frankfurt, Germany (3.71.180.249). Analysis indicates the site is protected by DDoS-Guard, a service often used to obscure malicious infrastructure, as evidenced by the page title returned during initial requests. The domain returns an HTTP 301 redirect, suggesting it may be funneling traffic to another endpoint, though the final destination remains unclear at this time. Infrastructure review reveals the domain uses nameservers ares.trustname.com and zeus.trustname.com, consistent with the registrar’s default configuration. The SSL certificate is issued by Let’s Encrypt (R13), a common choice for both legitimate and malicious sites due to its free and automated issuance process. While the certificate itself provides no inherent indication of malicious intent, its presence does not mitigate the domain’s phishing classification. The domain appears on one security blocklist and has been documented in a single AlienVault OTX threat intelligence pulse, reinforcing its association with fraudulent activity. Defenders should note that the domain is currently active and has been flagged by one out of 95 security vendors on VirusTotal, indicating limited but confirmed detection. The Gridinsoft trust score of 0/100 further supports its classification as high-risk. Given the use of DDoS-Guard and the domain’s recent registration, it is likely part of a broader campaign leveraging disposable infrastructure. Organizations are advised to block the domain at the DNS or network level and monitor for related indicators, including the IP address 3.71.180.249 and associated nameservers. Additional scrutiny of domains registered through the same registrar or resolving to the same IP range may uncover further malicious activity.