# PhishDestroy threat dossier — rxpharmacyoutlet.com ================================================================ Fetched: 2026-07-17 20:00:05 UTC Canonical: https://phishdestroy.io/domain/rxpharmacyoutlet.com/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 88/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 2/91 security vendors flagged this domain Flagging vendors: SOCRadar Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 34.149.36.179 (US, Kansas City) ASN: AS396982 Google LLC Hosting org: Google Cloud Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED !!! REGISTRAR INTEGRITY ALERT — NiceNIC !!! NiceNIC International: over 90% of its registered domains are associated with illegal content; documented systematic abuse-report non-response. Primary sources: https://phishdestroy.io/nicenic-real https://phishdestroy.io/nicenic-verdict Nameservers: ns1.siteground.net, ns2.siteground.net Registered: 2026-07-08 Expires: 2027-07-08 Page title: Licensed Online Pharmacy USA | Rx Prime Pharmacy HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR2 Expires: 2026-10-06 Status: INVALID chain Fingerprint: e8ab9cb426cdb1d4d38e40e81f4a0c854b56ad94048688b8e213399d9daba42f Subject Alternative Names (related infrastructure — often same operator): - www.rxpharmacyoutlet.com ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-07-08 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-11 16:29:06 UTC (by PhishDestroy tracker) Last verified: 2026-07-17 20:20:45 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f5193-fdb3-70ed-8b08-21dc4bb14811/ Wayback Machine: https://web.archive.org/web/*/rxpharmacyoutlet.com crt.sh CT logs: https://crt.sh/?q=%25.rxpharmacyoutlet.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=rxpharmacyoutlet.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/rxpharmacyoutlet.com URLhaus: https://urlhaus.abuse.ch/host/rxpharmacyoutlet.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-12 18:40:51 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] rxpharmacyoutlet.com — Generic Phishing Investigation The domain rxpharmacyoutlet.com was registered on July 08, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and remains active as of the report date. It is hosted on a Google Cloud infrastructure in the United States and resolves to the IP address 34.149.36.179. The domain’s authoritative name servers are ns1.siteground.net and ns2.siteground.net, indicating the use of a shared hosting provider for the web front‑end. Infrastructure analysis shows the web service is powered by Nginx and presents a valid Let's Encrypt certificate (YR2) that was automatically issued. An HTTP request to the root returns a 202 status code, suggesting the server is responding but the content has not been publicly disclosed. No additional technology stacks or content management systems are visible from the limited data set. Threat detection sources have flagged the domain as malicious. PhishDestroy has added it to its blocklist, and it appears on one additional security blocklist. VirusTotal scans report that 2 of 95 security vendors flagged the domain, providing limited but corroborating evidence of abuse. The risk rating is high and the operational status is listed as active, reinforcing the need for immediate defensive action. Defenders should prioritize blocking traffic to 34.149.36.179 and the hostname rxpharmacyoutlet.com at network perimeters and endpoint filters. Continuous monitoring of DNS queries and TLS certificate changes is advised, as rapid re‑issuance could indicate a shift in malicious activity. Given the sparse public content, analysts should consider sandboxing the URL if a sample becomes available to confirm payload behavior. Until further forensic evidence is gathered, the domain should be treated as a high‑confidence phishing indicator and incorporated into threat‑intel feeds for proactive mitigation. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 8ec73b00391b0484d0ad486c34c2e267 TLS cert SHA-256: e8ab9cb426cdb1d4d38e40e81f4a0c854b56ad94048688b8e213399d9daba42f ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/rxpharmacyoutlet.com/ JSON API: https://api.destroy.tools/v1/check?domain=rxpharmacyoutlet.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 179,927 domains (51,337 alive under monitoring, 128,590 confirmed takedowns/dead). Site: https://phishdestroy.io