xn--modafiniloespaa-crb[.]com

PhishDestroy has confirmed that xn--modafiniloespaa-crb.com is a generic phishing site, currently under investigation with a risk level of under_investigation. The domain was flagged for impersonating a legitimate pharmacy platform, specifically targeting Spanish-speaking users searching for Modafinilo, a cognitive enhancer. The site's title, "INICIO - Modafinilo España," was designed to trick visitors into believing they were on an official site, while in reality it was set up to harvest sensitive information.

Technical analysis reveals several red flags. The domain was created on December 27, 2019, and registered through Fewmoretaps OU d/b/a Trustname.com, a registrar known for hosting questionable domains. It resolves to IP address 92.113.23.255. Despite having an SSL certificate issued by Let's Encrypt (R13), which provides encryption, the site's intent was malicious. VirusTotal reports 0 detections out of 95 security vendors, meaning it was not flagged by antivirus engines at the time of analysis. However, it appears on 1 security blocklist, indicating that at least one threat intelligence source recognized it as harmful. The domain is currently offline, suggesting it was either taken down by authorities or abandoned by the operators.

Users who encountered this site should exercise caution. Although the domain is now offline, similar phishing sites may appear. To stay safe, always verify the URL of any pharmacy website, especially those offering prescription medications. Avoid entering personal or financial information on sites that lack verifiable contact details or have suspicious domain names. Use reputable security software and consider checking domain reputation on trusted platforms. If you have already interacted with this site, monitor your accounts for unusual activity and consider changing any passwords that may have been compromised.