Pemeriksaan phishing dan keamanan rxpharmacyoutlet.com

The domain rxpharmacyoutlet.com was registered on July 08, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and remains active as of the report date. It is hosted on a Google Cloud infrastructure in the United States and resolves to the IP address 34.149.36.179. The domain’s authoritative name servers are ns1.siteground.net and ns2.siteground.net, indicating the use of a shared hosting provider for the web front‑end.

Infrastructure analysis shows the web service is powered by Nginx and presents a valid Let's Encrypt certificate (YR2) that was automatically issued. An HTTP request to the root returns a 202 status code, suggesting the server is responding but the content has not been publicly disclosed. No additional technology stacks or content management systems are visible from the limited data set.

Threat detection sources have flagged the domain as malicious. PhishDestroy has added it to its blocklist, and it appears on one additional security blocklist. VirusTotal scans report that 2 of 95 security vendors flagged the domain, providing limited but corroborating evidence of abuse. The risk rating is high and the operational status is listed as active, reinforcing the need for immediate defensive action.

Defenders should prioritize blocking traffic to 34.149.36.179 and the hostname rxpharmacyoutlet.com at network perimeters and endpoint filters. Continuous monitoring of DNS queries and TLS certificate changes is advised, as rapid re‑issuance could indicate a shift in malicious activity. Given the sparse public content, analysts should consider sandboxing the URL if a sample becomes available to confirm payload behavior. Until further forensic evidence is gathered, the domain should be treated as a high‑confidence phishing indicator and incorporated into threat‑intel feeds for proactive mitigation.