ivermectin-3mg[.]com

The domain ivermectin-3mg.com was registered on April 24, 2026 through Fewmoretaps OU d/b/a Trustname.com. It is currently active and serves HTTP responses with status code 403. The site is listed on a single security blocklist and has been blocked by PhishDestroy. Two out of ninety‑five VirusTotal scanners have flagged the domain, indicating a low but non‑zero detection rate. Infrastructure analysis shows the domain resolves to the IPv4 address 3.71.180.249, which belongs to an Amazon Web Services EC2 instance in the eu‑central‑1 region (Germany). The authoritative name servers are ares.trustname.com and zeus.trustname.com. The TLS certificate is issued by Let’s Encrypt (R13), confirming the use of a free, automated certificate. Risk assessment classifies the domain as high‑risk generic phishing. The combination of a recent creation date, a zero‑score Gridinsoft trust rating, and inclusion in an AlienVault OTX pulse reinforces the malicious intent. The presence of a Let’s Encrypt certificate and a 403 response may be used to obscure content while still delivering credential‑harvesting pages to targeted users. However, the exact phishing payload and targeted brand have not been observed in the available intelligence. Defenders should block network traffic to 3.71.180.249 and add ivermectin-3mg.com to URL filtering and email security policies. Monitoring for DNS queries to the listed name servers can provide early detection of internal attempts to resolve the domain. Continuous re‑evaluation of VirusTotal and other sandbox results is recommended, as additional scanners may flag the site as malicious as its payload evolves.