# finlandpharma.com — SUSPICIOUS

> Domain finlandpharma.com is a fake pharma site pushing credential theft; VirusTotal shows 0/95 detections. Verify all senders before submitting login details.

## Summary
PhishDestroy identifies an active brand-impersonation campaign centered on the domain finlandpharma.com, currently classified as credential-theft phishing. The campaign status is active and under investigation by multiple threat-intelligence teams.


The domain finlandpharma.com was flagged by 0 of 95 VirusTotal vendors at time of discovery, indicating it remains under the radar of most antivirus engines. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, resolves to IP address 141.98.11.218, and obtained a Let’s Encrypt SSL certificate on April 7, 2025. Security telemetry shows the domain has appeared on 1 blocklist curated by PhishDestroy, which currently blocks traffic to this host. Independent reputation engines assign the IP a low trust score due to its recent creation and lack of legitimate use history.


Active takedown procedures are ongoing; however, the domain remains accessible and capable of harvesting user credentials under the false pretense of a legitimate pharmaceutical portal. Organizations and individuals are advised to block inbound connections to 141.98.11.218, inspect DNS resolutions for finlandpharma.com, and implement multi-factor authentication on all corporate and personal accounts. If credentials have been entered, rotate passwords immediately and enable account-recovery options. Report any sightings to PhishDestroy via their abuse portal to accelerate remediation.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2025-04-07 10:38:25
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 141.98.11.218

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/ff8a334b-7661-4cf9-9897-ef2aea3c6f92
- PhishDestroy: https://phishdestroy.io/domain/finlandpharma.com/
- LLM endpoint: https://phishdestroy.io/domain/finlandpharma.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/finlandpharma.com/
Last updated: 2026-03-27