doxycycline-hyclatepurchase[.]com

This domain, doxycycline-hyclatepurchase.com, is flagged as an active banking phishing threat with a high-risk classification. Analysis indicates the domain was registered on April 24, 2026, and currently resolves to IP address 3.71.180.249, hosted on infrastructure located in Germany within the AWS EC2 eu-central-1 region. The domain returns an HTTP 301 redirect status, suggesting it may be part of a larger redirection chain leading to a phishing landing page. Nameservers are provided by ares.trustname.com and zeus.trustname.com, and the domain was registered through Fewmoretaps OU operating as Trustname.com. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites. Infrastructure analysis reveals the domain is protected by DDoS-Guard, a service frequently observed in phishing and fraudulent operations due to its anonymizing capabilities. The domain appears on one security blocklist and is blocked by at least one anti-phishing service. While two of 94 security vendors on a detection platform have flagged the domain, this alone does not confirm malicious intent but supports the broader risk assessment. The domain's content has not been fully analyzed, so the specific banking brand or institution being targeted remains unconfirmed. Defenders should treat this domain as a confirmed phishing threat based on its infrastructure, registration details, and existing security flags. Immediate action is recommended, including blocking the domain and IP at the network level, monitoring for related redirection activity, and investigating any internal access attempts. Given the domain's recent registration and active status, further monitoring of associated infrastructure is advised to identify emerging threats.