doxycycline100mg-hyclate[.]com

This domain, doxycycline100mg-hyclate.com, is currently under investigation for credential theft targeting users seeking pharmaceutical products. The site is designed to harvest login credentials, payment information, or personal data under the guise of a legitimate pharmacy. As of the latest assessment, the domain has been taken offline, though prior activity suggests it was operational for malicious purposes. Analysis of the infrastructure reveals the domain was registered on April 21, 2026, through Fewmoretaps OU d/b/a Trustname.com. It resolves to the IP address 3.71.180.249 and uses a Let's Encrypt SSL certificate (R13). Despite its apparent legitimacy, the domain has not been flagged by any of the 95 vendors on VirusTotal, though it appears on one security blocklist. The page title, DDoS-Guard, suggests the use of a content delivery or protection service often associated with malicious infrastructure. Additionally, the domain was referenced in one AlienVault OTX threat intelligence pulse, indicating prior suspicion. The current offline status does not eliminate the risk, as domains of this nature frequently reappear under similar or altered infrastructure. Users who may have interacted with this site should monitor financial statements for unauthorized transactions and consider resetting credentials for any accounts entered. Organizations should update blocklists to include this domain and its associated IP address. Further monitoring of newly registered domains with similar naming patterns or registrar associations is recommended to preempt potential resurgence.