dragonpharmastore[.]org

dragonpharmastore.org was observed in July 2026 as a domain used for generic phishing. The domain was registered on 23 February 2026 through NiceNIC International Group Co., Limited and delegated to Cloudflare nameservers susan.ns.cloudflare.com and yichun.ns.cloudflare.com. DNS resolution points to IP 188.114.96.3, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The site presented a single HTTP response with the page title “Just a moment…”, and the TLS handshake was terminated by a certificate issued by Google Trust Services under the WE1 root, indicating a valid‑looking HTTPS connection.

Cloudflare‑specific technologies such as Browser Insights and HTTP/3 were detected, which is consistent with a typical Cloudflare‑protected site. Threat intelligence shows the domain is listed on one security blocklist and has been explicitly blocked by the PhishDestroy service. VirusTotal analysis recorded two positive detections out of ninety‑three scanned scanners, confirming that at least two security vendors have flagged the domain as malicious. No additional public reports or detailed payload information are currently available, and the site has been taken offline at the time of this assessment.

Given the observed infrastructure, defenders should continue to block traffic to dragonpharmastore.org at network perimeter devices, update URL filtering and DNS sinkhole rules, and monitor for any re‑registration or similar domains using the same registrar or Cloudflare name servers. Analysts should also consider sharing the domain's indicators of compromise with threat‑sharing communities to aid broader detection. Until further evidence emerges, the domain should be treated as a confirmed phishing resource.