propeciafinasterideonline[.]net

propeciafinasterideonline.net was created on April 21, 2026 via the registrar Fewmoretaps OU d/b/a Trustname.com. The domain points to the IPv4 address 3.71.180.249, which belongs to an Amazon Web Services EC2 instance in the eu‑central‑1 region hosted in Germany. The site presents a valid Let’s Encrypt certificate (R13) and responds with HTTP status code 301, redirecting visitors to another location. Authoritative DNS is served by ares.trustname.com and zeus.trustname.com.

Accessing the domain returns a page titled “DDoS‑Guard”, a generic label often used by malicious operators to mask the true content of a site. The combination of a legitimate TLS certificate and a generic title may be intended to increase user trust while concealing phishing or malware distribution behind the redirect.

Open Threat Exchange records the domain in a single intelligence pulse, and PhishDestroy has already added it to its blocklist. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one additional security blocklist. VirusTotal currently shows 0 detections out of 95 submitted samples, indicating that automated scanners have not yet flagged the content. The low trust score and blocklist presence suggest that the domain is being used for malicious purposes despite the lack of public detections.

Defenders should treat propeciafinasterideonline.net as a potential phishing or malicious site. Immediate actions include blocking the domain and its resolved IP address at network perimeters, adding the name servers to DNS filtering policies, and monitoring TLS certificate changes for re‑issuance. Analysts should also retrieve the final redirect target, capture a full page snapshot, and submit the content to malware sandboxes to confirm the payload. Ongoing surveillance of the associated AWS instance is advised, as the infrastructure could be repurposed for additional campaigns.