zithromax-azithromycin-buy[.]info

zithromax-azithromycin-buy.info is identified as a generic phishing site targeting users searching for antibiotic purchases. The domain was registered on April 28, 2026 and is currently flagged as high risk. It is active as of the report date (July 12, 2026) and appears in a single AlienVault OTX pulse and one security blocklist maintained by PhishDestroy. The registration record lists Fewmoretaps OU d/b/a Trustname.com as the registrant. Authoritative name servers are zeus.trustname.com and ares.trustname.com, both of which resolve to the IPv4 address 3.71.180.249. The IP belongs to an Amazon Web Services EC2 instance in the eu-central-1 region, physically located in Germany. The site presents a Let’s Encrypt R12 certificate, but HTTP requests return a 403 status code, indicating that content is being deliberately hidden or restricted. Reputation services provide a mixed picture. Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal has a single detection out of 95 scanned vendors. The low detection count suggests limited exposure, yet the presence on a dedicated phishing blocklist confirms malicious intent. The OTX pulse and blocklist entry are the only public references, leaving the exact phishing campaign details—such as the spoofed brand or credential collection page—unconfirmed. Defenders should treat the domain as hostile. Immediate mitigation steps include adding the domain and its resolving IP (3.71.180.249) to outbound and inbound deny lists, and configuring web proxies to block TLS connections to the associated Let’s Encrypt certificate. Continuous monitoring of the two trustname.com name servers is advisable, as they may be used to host additional malicious zones. Given the recent creation date and active status, threat hunting teams should also search for related indicators of compromise in recent email traffic and web logs.