medicamentoscompreco[.]com

This domain, medicamentoscompreco.com, is flagged as an active e-commerce scam targeting Portuguese-speaking users with fraudulent pharmaceutical sales. Registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to Cloudflare IP 188.114.96.3 (AS13335, Canada) and uses Cloudflare nameservers (bayan.ns.cloudflare.com, savanna.ns.cloudflare.com). The site returns an HTTP 200 status, indicating operational hosting, and employs Cloudflare Browser Insights and HTTP/3 for performance and evasion. The page title 'Medicamentos com preço' suggests a focus on discounted medications, a common lure in fake pharmacy schemes. Analysis indicates low detection coverage, with only 3 of 94 security vendors flagging the domain on VirusTotal. It appears on one security blocklist and has been documented in a single AlienVault OTX pulse, reflecting limited but confirmed malicious activity. The domain's infrastructure relies on Cloudflare's CDN, which may obscure origin servers and complicate takedown efforts. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider, which does not mitigate the domain's fraudulent intent. Defenders should prioritize blocking this domain at DNS and network layers, particularly in environments serving healthcare, e-commerce, or Portuguese-speaking regions. Monitor for related domains using the same registrar or nameserver patterns, as NICENIC registrations are frequently associated with phishing campaigns. Given the domain's recent creation and active status, assume it remains a live threat until evidence of takedown or inactivity emerges. The exact content and payment mechanisms are not yet analyzed, but the scam type aligns with known fake pharmacy tactics, including counterfeit product sales and payment fraud.