emrtrustpharm[.]com

This domain, emrtrustpharm.com, operates as a credential theft site designed to harvest login details from users attempting to access medical or pharmaceutical services. The site presents itself as a legitimate healthcare portal, tricking visitors into entering sensitive information such as usernames, passwords, or personal health data. Once submitted, this information is captured by threat actors for unauthorized access, identity theft, or further exploitation in targeted attacks. Analysis indicates this domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious infrastructure. Security vendors on VirusTotal flagged the domain, with 4 out of 95 engines detecting it as malicious. The site resolved to the IP address 141.98.11.218 and appeared on at least one security blocklist before being taken offline. The combination of a recent creation date, low detection rates, and association with a high-risk registrar suggests an attempt to evade detection while targeting unsuspecting users. If you visited emrtrustpharm.com or entered any credentials on the site, immediate action is required. First, change passwords for any accounts that may have been compromised, prioritizing email, financial, and healthcare-related services. Enable multi-factor authentication where available to add an additional layer of security. Monitor accounts for unusual activity, such as unauthorized logins or transactions, and report any suspicious behavior to the relevant service providers. Additionally, consider running a full scan of your device using updated security software to detect potential malware or keyloggers that may have been installed during the visit.