buycertificatesonline[.]net

The domain buycertificatesonline.net is identified as a credential theft phishing infrastructure targeting users seeking SSL certificates. Analysis indicates the site is designed to harvest login credentials, payment details, or personal information under the guise of selling digital certificates. As of the latest assessment, the domain has been marked as taken_down, though historical data remains relevant for threat intelligence purposes. Infrastructure analysis reveals the domain was registered on April 12, 2026, through Fewmoretaps OU d/b/a Trustname.com. It resolves to the IP address 91.223.82.8 and employs technologies including WordPress, MySQL, PHP, LiteSpeed, jQuery, and HTTP/3. The domain appears on one security blocklist and is flagged by 4 of 95 security vendors on VirusTotal. Trust scores from Gridinsoft and Scamadviser are 0/100 and 21/100, respectively. The SSL certificate is issued by Let's Encrypt, a common tactic to lend false legitimacy to phishing sites. The current status of buycertificatesonline.net is taken_down, indicating the infrastructure is no longer actively serving malicious content. However, users and organizations are advised to remain vigilant, as threat actors frequently repurpose or re-register similar domains. Network defenders should block the IP address 91.223.82.8 and monitor for related domains registered through Fewmoretaps OU. End users should verify the legitimacy of any site offering SSL certificates by cross-referencing with known certificate authorities and checking for valid trust indicators. If credentials or payment details were entered on this domain, immediate password resets and financial account monitoring are recommended.