mppharma[.]biz

The domain mppharma.biz was registered on March 26, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the Cloudflare‑hosted IP address 188.114.96.3, which is geolocated to Canada. Authoritative nameservers are jonah.ns.cloudflare.com and meera.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and proxy services. The site presents a Google Trust Services / WE1 SSL certificate, confirming HTTPS is enabled despite the underlying content returning HTTP 403. Threat intelligence feeds flag the domain as high‑risk: VirusTotal reports 4 of 95 scanners flagging it, Gridinsoft assigns a trust score of 0/100, and AlienVault OTX has linked the domain to 22 separate pulses. PhishDestroy already blocks the domain, and it appears on one external blocklist. Current analysis cannot identify a specific brand or service being spoofed because the HTTP 403 response prevents retrieval of the landing page. No malicious payloads have been captured, and no associated phishing kits have been observed in public repositories. Consequently, the exact social engineering vector remains uncertain, though the high‑risk classification suggests a credential‑ harvesting motive. Defenders should add mppharma.biz to network and endpoint blocklists, enforce DNS sinkholing for the domain, and monitor outbound connections to the 188.114.96.3 address. Email security gateways should be tuned to flag messages containing the domain or its URL variations. Continuous monitoring of Cloudflare‑related activity and periodic re‑scans with updated antivirus engines are advised to detect any evolution of the payload.