alphamegapharmacy[.]com

Analysis of alphamegapharmacy.com indicates a newly registered domain (creation date 21 April 2026) that is currently active and associated with a generic phishing threat. The domain resolves to IP address 3.71.180.249, an AWS EC2 instance in the eu-central-1 region of Germany. DNS is served by ares.trustname.com and zeus.trustname.com, both appearing to be under the same registrar (Fewmoretaps OU d/b/a Trustname.com). The site presents a TLS certificate issued by Let’s Encrypt (R12) and displays the page title "DDoS-Guard," which does not correspond to a known brand or service and suggests the content has not been publicly detailed. Infrastructure cues show a Gridinsoft trust score of 0/100, and the domain appears on a single security blocklist, has been flagged by PhishDestroy, and is referenced in one AlienVault OTX pulse. No detections have been reported by VirusTotal, but the absence of detections does not confirm safety. Current uncertainties include the exact payload or credential‑harvesting mechanisms employed, as the landing page has not been examined. Defenders should consider immediate network‑level blocking of the domain and its resolved IP, monitor DNS queries for the associated nameservers, and maintain vigilance for any related phishing campaigns that may reference the same infrastructure. Ongoing observation is recommended to detect any escalation or new intelligence linking the domain to broader malicious activity.