neomodafinil[.]org

The domain neomodafinil.org is identified as a phishing site primarily targeting credential theft. The site appears to impersonate a pharmacy named AfinilEU, offering to sell Modafinil at low prices to lure unsuspecting users into providing their login credentials.

Analysis of the domain reveals a VirusTotal score of 4/95, indicating that while the majority of security vendors do not flag it, there is still a notable risk. The domain is registered through Fewmoretaps OU d/b/a Trustname.com and resolves to the IP address 3.71.180.249. It was created on April 24, 2026, and the SSL certificate is issued by Let's Encrypt. The domain appears on one security blocklist and has a Gridinsoft trust score of 0/100, which reflects a complete lack of trustworthiness. It is also mentioned in one threat intelligence pulse on AlienVault OTX.

The domain is currently offline, which indicates a potential response action has been taken, such as takedown by the registrar or hosting provider. However, the infrastructure used to host the domain (IP address 3.71.180.249) may still pose a risk and should be monitored. Organizations are advised to update their DNS blocklists to include neomodafinil.org and to educate users about the risks of credential theft through phishing sites. Continuous monitoring of the domain and associated infrastructure is recommended to ensure it does not re-emerge in a different form or location.