modafinil-online[.]com

PhishDestroy identifies modafinil-online.com as an active generic phishing domain impersonating a legitimate pharmacy to distribute counterfeit prescription medications while secretly deploying a cryptocurrency drainer. The site poses an elevated risk to users seeking cheap pharmaceuticals, as it combines fake drug sales with direct theft of digital assets. This campaign exploits trust in online pharmacies to harvest both personal data and cryptocurrency, making it a dual-threat operation.

This domain was flagged by VirusTotal with a detection ratio of 1 out of 95 security vendors, indicating low but present suspicion. It was registered through Fewmoretaps OU d/b/a Trustname.com on October 13, 2017, and resolves to the IP address 3.71.180.249. The domain uses a Let's Encrypt SSL certificate, which does not validate its legitimacy. Notably, despite its age, there is no evidence of inclusion on major blocklists or threat intelligence feeds, suggesting either a stealthy operation or a recently escalated campaign.

To mitigate risk from this domain, users should avoid visiting modafinil-online.com entirely due to the confirmed presence of a cryptocurrency drainer. If interaction has already occurred, immediately disconnect from the internet and scan all connected devices for malware. Use PhishDestroy’s verification tool to confirm the site’s status before engaging, and report any suspicious transactions to relevant financial authorities. Always purchase prescription medications through licensed pharmacies with verified credentials to prevent exposure to counterfeit or malicious products.