viabestbuy[.]com

This domain resolves to IP 3.71.180.249 and uses a technology stack that includes WordPress, PHP, MySQL, Bootstrap, cart functionality, Yoast SEO components, and Zendesk. The domain was created on September 27, 2016 through registrar Fewmoretaps OU d/b/a Trustname.com and presents an SSL certificate issued by Let's Encrypt. Its observed page title directly references low-cost generic medication sales in the USA, consistent with the generic_phishing classification and high risk level assigned to the active site.

Infrastructure analysis reveals listings in 23 AlienVault OTX pulses along with appearances on 2 security blocklists where it is specifically blocked by PhishDestroy and BLP-Malware. VirusTotal detection stands at 5 out of 95 vendors while the Gridinsoft trust score registers at 0 out of 100. The combination of long domain age, multiple independent blocklist entries, and ongoing activity provides concrete indicators of sustained malicious use rather than isolated or recent deployment.

What remains uncertain is the precise scale of downstream campaigns or additional infrastructure tied to the same registrant or IP, as only the listed observables are available. The presence of e-commerce and support technologies suggests operational focus on transaction handling, yet no further ASN or geolocation details are supplied to narrow attribution.

Defenders should incorporate the IP 3.71.180.249 and domain into blocklists and monitoring rules, cross-reference against the 23 OTX pulses for related indicators, and review any inbound traffic or email references to the domain. Continued observation of the active status is warranted given the established detection history and zero trust score.