modafinil-australia[.]net

Analysis of modafinil-australia.net shows a newly registered domain (created 28 April 2026) that is actively serving malicious content. The site resolves to IP 31.184.236.235, hosted in the Czech Republic and operated by Makis Systems Ltd. The domain uses a Let’s Encrypt E7 certificate, and HTTP requests receive a 302 redirect to a page titled “Bot Detection”. Nameservers ns001.steady-dns.com and ns002.steady-dns.com resolve the domain, while the MX record points to mixin.modafinil-australia.net. The domain is already listed on a security blocklist and has been flagged by PhishDestroy, indicating that defensive feeds consider it malicious.

Threat intelligence correlates the domain with generic phishing activity. It appears in 23 AlienVault OTX pulses, reinforcing its association with phishing campaigns. The Gridinsoft trust score of 0/100 further reflects a lack of reputational trust. Although VirusTotal currently shows no detections, the absence of detections does not imply safety, especially given the other strong indicators. The presence of a bot‑detection page after redirection suggests an attempt to evade automated analysis and to present a human‑visible challenge before delivering credential‑stealing content.

Defenders should block network connections to 31.184.236.235 and any subdomains of modafinil-australia.net, update email filters to reject messages claiming to originate from this domain, and monitor DNS queries for the associated nameservers. Incident response teams should treat any credentials submitted to the site as compromised and advise users to reset affected accounts. Continuous monitoring of the domain’s reputation, especially any changes in VirusTotal detections or additional blocklist listings, is advised.