finasteride-buy-propecia[.]net

This domain, finasteride-buy-propecia.net, is currently active and flagged as high-risk phishing infrastructure targeting pharmaceutical fraud. Registered on November 17, 2025, through Fewmoretaps OU (operating as Trustname.com), the domain resolves to IP address 3.71.180.249 and is protected by DDoS-Guard, a service frequently associated with bulletproof hosting for malicious campaigns. The page title explicitly displays 'DDoS-Guard,' reinforcing the use of this protective layer. Analysis indicates the domain has been documented in 22 threat intelligence pulses on AlienVault OTX and appears on two security blocklists. Seven of 95 security vendors on VirusTotal detect the domain as malicious, though the specific payload or lure remains unconfirmed. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and fraudulent sites due to its free, automated issuance. Gridinsoft assigns a trust score of 0/100, further supporting its classification as malicious. While the domain name suggests a focus on pharmaceutical products (finasteride/Propecia), no direct brand impersonation has been confirmed in available data. The exact content of the site has not been analyzed, so the presence of order forms, payment interception, or credential harvesting remains unverified. Defenders should treat this domain as active phishing infrastructure, block resolution at the network level, and monitor for connections from internal assets. Given its inclusion in multiple threat feeds and use of bulletproof hosting, this domain is likely part of a broader fraud campaign rather than an isolated incident.