pharm-gdd[.]com

This domain is flagged as a credential phishing threat targeting users through deceptive login portals. Analysis indicates an elevated risk profile due to its recent registration and active malicious classification by multiple security sources. Credential phishing remains a prevalent attack vector, often leveraging fake authentication pages to harvest sensitive account details, including usernames, passwords, and multi-factor authentication codes. Infrastructure analysis reveals the domain pharm-gdd.com was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 141.98.11.218, which has been linked to prior phishing and malware distribution campaigns. The domain appears on one security blocklist and is flagged by 4 out of 95 security vendors on VirusTotal. Additionally, it holds a Gridinsoft trust score of 0/100 and is referenced in one AlienVault OTX threat intelligence pulse, further corroborating its malicious classification. The domain has since been taken offline, though historical resolution data suggests it may have been part of a broader, short-lived phishing operation. Organizations and individuals are advised to implement immediate mitigation measures to counteract credential phishing threats. Network-level blocking of the domain pharm-gdd.com and its associated IP 141.98.11.218 should be enforced across firewalls, DNS filters, and endpoint protection systems. Security teams should conduct retrospective log analysis to identify any prior connections to this infrastructure and reset credentials for users who may have interacted with the domain. User education programs should emphasize the identification of phishing indicators, such as spoofed login pages, urgency-driven messaging, and suspicious domain names. Multi-factor authentication (MFA) should be enforced as an additional safeguard to mitigate the impact of credential theft.