doxycyclineorder[.]info

PhishDestroy has analyzed the domain doxycyclineorder.info and identified it as a generic phishing site, currently under investigation and already taken offline. The site was designed to impersonate a legitimate pharmacy, likely to steal credentials or personal information from visitors seeking medication. The page title displayed 'DDoS-Guard', which may indicate an attempt to appear as a security service or to obscure the true nature of the site.

Technical indicators provide a clearer picture of the threat. The domain was registered on April 21, 2026, through Fewmoretaps OU d/b/a Trustname.com, a known registrar for low-quality domains. It resolved to IP address 3.71.180.249 and used a Let's Encrypt SSL certificate (R13), which is common among both legitimate and malicious sites. VirusTotal reported 0 detections out of 95 vendors, meaning the site was not flagged by security tools at the time of analysis, but it did appear on one security blocklist. This low detection rate underscores the importance of proactive threat hunting.

Although the site is now offline, the risk to users who may have visited it earlier remains. PhishDestroy recommends that anyone who entered personal or financial information on doxycyclineorder.info should change their passwords immediately and monitor their accounts for suspicious activity. As a general rule, users should verify the legitimacy of online pharmacies through official channels before making any transactions. Avoid clicking on unsolicited links offering prescription medications, as they often lead to phishing sites or counterfeit products.