diflucan-fluconazolebuy[.]net

This domain, diflucan-fluconazolebuy.net, is flagged as an active pharmaceutical phishing site targeting users seeking antifungal medication. Registered on July 28, 2025, through Fewmoretaps OU d/b/a Trustname.com, the domain currently resolves to IP 3.71.180.249, hosted on AWS EC2 in Germany (eu-central-1). Infrastructure analysis reveals the use of DDoS-Guard protection, a service frequently employed by threat actors to obscure malicious infrastructure. The page title, 'DDoS-Guard,' aligns with this detection, though no specific brand impersonation or phishing kit is confirmed in available data. The domain employs a Let's Encrypt SSL certificate (R12) and utilizes nameservers ares.trustname.com, ns1.anycastdns.cz, ns2.anycastdns.cz, and zeus.trustname.com, a configuration consistent with bulletproof or low-reputation hosting providers. It returns an HTTP 301 redirect, suggesting it may forward visitors to another malicious endpoint, though the destination is not yet identified. The domain appears on one security blocklist and is flagged by 4 of 91 vendors on VirusTotal, indicating moderate but not universal detection. Defenders should prioritize blocking this domain at the DNS and network level, particularly in healthcare or e-commerce environments where pharmaceutical scams are prevalent. The use of DDoS-Guard and Trustname-hosted nameservers further justifies categorizing this as high-risk infrastructure. No evidence of takedown or sinkholing is observed as of July 12, 2026, and the domain remains operational. Additional monitoring is recommended to identify downstream redirect targets or associated campaigns.