doxycyclinebuy[.]info

The domain doxycyclinebuy.info was registered on 24 April 2026 by the entity Fewmoretaps OU operating under the trade name Trustname.com. Within weeks of its creation the domain began serving malicious content identified as a generic phishing campaign. Its risk rating is high and the domain remains active as of 12 July 2026.

Infrastructure analysis shows the domain resolves to the IPv4 address 3.71.180.249, which belongs to an Amazon Web Services EC2 instance in the eu‑central‑1 region located in Germany. The authoritative name servers are zeus.trustname.com and ares.trustname.com, both matching the registrar’s branding. An SSL certificate issued by Let’s Encrypt (R13) is present, but HTTP requests return a 403 status code, indicating intentional access restriction.

Reputation data corroborates the malicious intent. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist. AlienVault OTX references the domain in one threat‑intel pulse. VirusTotal analysis records three detections out of ninety‑five scanning engines, confirming that at least a minority of security products have flagged it.

Defenders should block network traffic to 3.71.180.249 and to the domain itself, as it is already listed by PhishDestroy. Email filtering rules that inspect URLs containing “doxycyclinebuy.info” can reduce exposure. Continuous monitoring of the associated name servers and the AWS region for new sub‑domains is advised, since the infrastructure could be reused for further campaigns. Incident response teams should treat any credential or payment information submitted to this site as compromised.