buymodafinilonline[.]org

buymodafinilonline.org is currently listed as an active generic‑phishing site with a high risk rating. The landing page advertises the purchase of Modafinil in Europe and uses the title “Buy Modafinil Online in Europe – AfinilEU Pharmacy & Lowest Prices.” The site redirects with an HTTP 301 response, indicating a permanent move to the same host, a technique frequently used to conceal malicious infrastructure.

The domain was registered on 21 April 2026 through Fewmoretaps OU d/b/a Trustname.com and is served by the authoritative nameservers zeus.trustname.com and ares.trustname.com. DNS resolution points to the IP address 3.71.180.249, which belongs to an Amazon Web Services EC2 instance in the eu‑central‑1 region (Germany). The TLS certificate is issued by Let’s Encrypt (R13), a widely used free certificate authority, providing no indication of legitimate business affiliation.

Threat intelligence confirms the site’s malicious nature. It appears on the PhishDestroy blocklist, and one of ninety‑five VirusTotal scanners flagged the domain, demonstrating at least one security vendor’s detection. AlienVault OTX references the domain in a single pulse, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the assessment of a low‑reputation host.

While the page content suggests a fraudulent pharmacy, no direct evidence of credential harvesting or payment‑card theft has been disclosed publicly. Defenders should block DNS resolution for the domain and its associated IP, enforce TLS inspection to detect the redirect, and monitor for outbound connections to the AWS EC2 instance. Continuous threat‑intel feeds should be consulted for any emerging indicators, and incident response teams should treat any user interaction with the site as compromised.