mediprousa[.]shop

The domain mediprousa.shop was registered through Spaceship, Inc. on April 27, 2026 and is currently active. DNS resolution points to the IPv4 address 91.202.233.53, which resolves to a hosting provider identified as Prospero OOO in Turkmenistan (TM). The authoritative nameservers are ns1.dns-true.com and ns2.dns-true.com. The site serves content over HTTPS using a Let’s Encrypt certificate issued by the E7 intermediate.

Threat intelligence shows the domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis returned five positive detections out of ninety‑five scanned engines, and the Gridinsoft trust score is 0 out of 100, indicating a high likelihood of malicious behavior. AlienVault OTX references the domain in a single pulse, further confirming its inclusion in threat feeds.

The page title retrieved from the HTTP 200 response reads “Pharmacy Discount & Special Offers – mediprousa.shop”, suggesting the site is masquerading as a discount pharmacy service to lure victims. No additional content has been captured, so the exact phishing flow and credential‑capture mechanisms remain unknown. Nonetheless, the combination of a recent registration, low‑reputation hosting, multiple blocklist listings, and a low trust score aligns with a high‑risk phishing campaign.

Defenders should add mediprousa.shop to deny‑list rules on perimeter firewalls, proxy servers, and DNS filtering solutions. Continuous monitoring of DNS queries for the domain and its associated IP address is advised, as well as the deployment of URL‑filtering controls to block HTTP and HTTPS requests. Incident response teams should treat any traffic to this domain as malicious and investigate related authentication attempts or credential submissions that may have been compromised.