buymodafinil[.]com

This domain, buymodafinil.com, was registered on April 28, 2026, through Fewmoretaps OU operating under Trustname.com, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain currently resolves to IP address 172.67.169.132, which is hosted on Cloudflare infrastructure in Canada. The use of Cloudflare nameservers (braden.ns.cloudflare.com and rosemary.ns.cloudflare.com) and a Google Trust Services SSL certificate (WE1) suggests an attempt to present a legitimate appearance while obscuring backend hosting details. The domain returns an HTTP 401 status, indicating an unauthorized access requirement, which is atypical for standard e-commerce or informational sites. This behavior may be employed to restrict visibility to automated scanners or security researchers while allowing targeted victims to proceed. Three out of ninety-five security vendors on VirusTotal have flagged the domain, and it appears on one security blocklist, with a Gridinsoft trust score of 0/100. Additionally, the domain is referenced in one AlienVault OTX threat intelligence pulse, further supporting its classification as malicious. While the specific phishing kit or targeted brand remains unconfirmed, the domain name suggests an intent to impersonate a vendor of modafinil, a controlled substance often marketed through illicit online pharmacies. The combination of recent registration, restricted access, and security vendor detections aligns with known patterns of counterfeit pharmaceutical distribution or credential harvesting operations. Defenders should treat this domain as high-risk and consider blocking resolution at the DNS level or monitoring for connections originating from internal networks. Given its active status as of July 12, 2026, ongoing vigilance is recommended.