modafinil-usa[.]org

Analysis of the domain modafinil-usa.org indicates a high‑risk phishing infrastructure. The domain was registered on 28 April 2026 through Fewmoretaps OU d/b/a Trustname.com and resolves to IP address 31.184.236.233, which is attributed to Makis Systems Ltd in the Czech Republic. The host presents a valid Let's Encrypt certificate (YE1) and returns an HTTP 302 redirect, a behavior commonly used to evade static analysis. The site’s page title is "Bot Detection," suggesting some form of automated traffic screening, but no further content analysis is available. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. It is listed in 23 AlienVault OTX pulses, reinforcing its association with malicious activity, and three of ninety‑one VirusTotal scanners have flagged it. Infrastructure details include three Joker.com nameservers (x.ns.joker.com, y.ns.joker.com, z.ns.joker.com) and an MX record pointing to mailme.modafinil-usa.org, a pattern often observed in phishing campaigns to control inbound mail. Gridinsoft assigns a trust score of 0/100, indicating extreme suspicion. While the exact payload or target brand is not disclosed, the combination of recent registration, low trust score, redirection, and multiple threat‑intel references constitutes strong evidence of a phishing operation. Defenders should block the domain at DNS and network layers, monitor for outbound connections to the associated IP, and consider email filtering for messages originating from the listed MX host. Continuous re‑evaluation is advised as additional indicators may emerge.