metronidazoleonlineflagyl[.]info

The domain metronidazoleonlineflagyl.info was registered on April 21, 2026 and currently resolves to the IP address 3.71.180.249, an Amazon Web Services EC2 instance in the eu-central-1 region of Germany. The site returns an HTTP 301 redirect and presents a TLS certificate issued by Let’s Encrypt (R13). Infrastructure analysis shows the domain is hosted on a cloud provider, uses nameservers zeus.trustname.com and ares.trustname.com, and was registered through Fewmoretaps OU d/b/a Trustname.com. Reputation data is extremely poor: Gridinsoft assigns a trust score of 0 / 100, the domain appears on a security blocklist, and it has been flagged in one AlienVault OTX pulse. VirusTotal scans report that four of ninety‑one security vendors have flagged the domain as malicious. The page title returned by the server is "DDoS-Guard," which does not correspond to any legitimate service associated with the domain name and suggests intentional misdirection. The domain is actively blocked by PhishDestroy, confirming its use in a phishing campaign. No direct content analysis is available, so the exact phishing payload or targeted brand cannot be confirmed at this time. Defenders should immediately block the domain and its associated IP address at perimeter defenses, update URL filtering and DNS sinkhole rules, and monitor for any related indicators of compromise. Continuous observation is advised to detect any changes in hosting or content that could indicate escalation of the campaign.