finasterideonline-propecia[.]org

The domain finasterideonline-propecia.org has been identified as a fake pharmacy phishing site targeting individuals seeking prescription hair loss treatments. Analysis indicates this domain impersonates legitimate pharmaceutical brands to deceive users into purchasing counterfeit or unapproved medications. As of the latest assessment, the domain is offline, though prior activity suggests it was actively engaged in fraudulent transactions and data harvesting. Infrastructure analysis reveals the domain was created on April 21, 2026, and registered through Fewmoretaps OU d/b/a Trustname.com. It resolved to the IP address 3.71.180.249 and utilized a Let's Encrypt SSL certificate, which is commonly exploited by threat actors to lend a false sense of legitimacy. The domain was flagged by 6 of 95 security vendors on VirusTotal, and it appears on at least one security blocklist. Additional trust assessments, such as the Gridinsoft trust score, assigned a rating of 0 out of 100, further corroborating its malicious nature. The page title, DDoS-Guard, suggests the use of a content delivery or protection service often abused by phishing operators to obscure hosting origins. Current evidence confirms the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the elevated risk classification remains due to the domain's recent activity and the persistent threat posed by similar fake pharmacy schemes. Organizations and individuals are advised to block the domain and its associated IP address at the network level. Users who interacted with the site should monitor financial accounts for unauthorized transactions and consider identity protection measures. Security teams are encouraged to review logs for connections to 3.71.180.249 and correlate with other known phishing indicators to identify potential compromise.