dashlasixhex[.]com

PhishDestroy identifies dashlasixhex.com as an active laxapro fake-prescription phishing portal designed to harvest patient credentials and payment details. The site masquerades as a legitimate Canadian pharmacy selling the ulcerative colitis drug Mesalamine under the brand name Laxapro. Once victims enter prescription information, the fake checkout page captures shipping data and credit card numbers, which are exfiltrated to a drop-server linked to Fewmoretaps OU.

Technical indicators confirm the threat’s maturity: the domain was created on March 22, 2026—less than 24 hours before initial detection—and is already resolving to Cloudflare IP 172.67.158.237. The attacker procured an immediately issued Let’s Encrypt SSL certificate (valid from March 22 18:44 UTC), boosting the page’s appearance of legitimacy. As of this advisory, VirusTotal shows zero detections across 95 engines, and the site remains absent from all major threat-intelligence blocklists, indicating a newly deployed campaign that still evades signature-based defenses. Registrant privacy is enabled via Trustname.com (Fewmoretaps OU), a bulletproof registrar frequently abused for short-lived pharma scams.

If you visited dashlasixhex.com, immediately cease use of any payment method entered on the site and contact your card issuer to request a new card number and chargeback for unauthorized transactions. Clear browser cookies related to the domain, run a full antivirus scan, and monitor bank statements for 90 days. Report the URL to your national cybercrime center and consider subscribing to a credit-monitoring service. Forward any captured screenshots or phishing e-mails to your organization’s security team for IOC extraction and takedown requests.