ialop[.]org

Analysis indicates that ialop.org is an active phishing domain targeting users with a fraudulent online pharmacy scheme. The domain was registered on April 28, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the site is hosted on a Digital Ocean IP address (206.81.13.131) located in the United States, with nameservers pointing to ns1.bestasotips.com and ns2.bestasotips.com, a pattern consistent with bulletproof hosting setups. The page title, 'International Association of Licensed Online Pharmacies | IALOP,' suggests an attempt to impersonate a legitimate regulatory or accreditation body, though no verified organization by that name exists. The domain is currently active, returning an HTTP 200 status, and uses a Let's Encrypt SSL certificate (E7), which provides encryption but does not validate legitimacy. Email infrastructure relies on MX records hosted at mx003.cloudeu.xion.oxcs.net, a provider often exploited for phishing campaigns. Threat intelligence confirms the domain appears on at least one security blocklist, with three of ninety-one security vendors flagging it on VirusTotal. AlienVault OTX has also recorded it in a threat intelligence pulse, further corroborating malicious activity. The Gridinsoft trust score of 0/100 reflects its high-risk classification. While the exact content of the site has not been analyzed, the combination of infrastructure, registration details, and threat indicators strongly suggests it is operating as a fraudulent online pharmacy. Defenders should treat this domain as hostile. Network-level blocking is recommended, particularly for organizations in healthcare, e-commerce, or sectors handling sensitive personal data. Monitoring for related domains registered through the same registrar or hosted on the same IP range may help identify additional threats from this actor.