buyarmodafinil[.]com

buyarmodafinil.com was registered on 28 April 2026 through Fewmoretaps OU d/b/a Trustname.com. The domain resolves to the Cloudflare address 188.114.96.3 and uses the nameservers ada.ns.cloudflare.com and paul.ns.cloudflare.com. Its SSL certificate is issued by Google Trust Services under the WE1 root, indicating a legitimate certificate chain despite the malicious intent.

The site has been flagged by the PhishDestroy blocklist and appears in a single AlienVault OTX pulse, confirming its association with a generic phishing campaign. HTTP requests receive a 403 response, which may be used to hide malicious content behind authentication checks. The Gridinsoft trust score of 0 / 100 further reflects a high‑risk rating, and the domain is listed on at least one additional security blocklist.

Current public scans show no detections on VirusTotal (0 / 95 engines), but the absence of alerts does not imply safety, as the payload may be delivered only after credential submission or via dynamic content. No specific phishing landing pages, lure text, or targeted brand details have been publicly disclosed, leaving the exact victim profile and lure technique uncertain.

Defenders should add buyarmodafinil.com to DNS and proxy blocklists, enforce TLS inspection to capture any post‑TLS payload, and monitor outbound connections to the 188.114.96.3 address. Continuous re‑scanning of the domain for changes in content or certificate status is recommended, as the infrastructure can be quickly altered behind Cloudflare’s front‑end. Alerting on similar domain patterns (e.g., “buy…modafinil”) can help pre‑empt future campaigns.