finasteridebuypropecia[.]org

finasteridebuypropecia.org was registered on April 24, 2026 through the commercial entity Fewmoretaps OU d/b/a Trustname.com. The domain is delegated to the nameservers zeus.trustname.com and ares.trustname.com, and it presents a valid Let's Encrypt R13 TLS certificate. The sole visible page title returned by the HTTP service is "DDoS-Guard", and the server issues an HTTP 301 redirect to the same host, indicating a minimal web footprint. The authoritative IP address resolves to 3.71.180.249, an Amazon Web Services EC2 instance located in the eu-central-1 region (Germany). The hosting choice aligns with a pattern of rapid‑deployment infrastructure often used by opportunistic threat actors. The domain appears on a single security blocklist and has been referenced in one AlienVault OTX pulse. Independent scoring from Gridinsoft assigns a trust score of 0 out of 100, and the domain is listed as blocked by PhishDestroy. VirusTotal scans show that 3 of 95 security vendors have raised detections on the domain, reinforcing its classification as a high‑risk impersonation campaign. The threat type is recorded as generic_phishing, with the specific scam category identified as impersonation. The current operational status is active, and the risk level is marked high, suggesting ongoing malicious use. Public analysis of the site’s content has not been published, so the exact payload or credential‑harvesting mechanisms remain unknown. Defenders should prioritize blocking finasteridebuypropecia.org at DNS and proxy layers, monitor outbound connections to the associated AWS IP, and incorporate the domain into threat‑intel feeds. Continuous re‑assessment is advised, as additional detections may emerge from deeper sandbox or sinkhole observations.