pharmacyonline-eu[.]com

pharmacyonline-eu.com was registered on 21 April 2026 through Fewmoretaps OU operating as Trustname.com. The WHOIS record shows the registrant name and the two authoritative nameservers ares.trustname.com and zeus.trustname.com. The domain resolves to the IPv4 address 3.71.180.249, an Amazon Web Services EC2 instance in the eu-central-1 region located in Germany. An HTTP request to the domain returns a 301 permanent redirect and the page title reported by scanners is “DDoS-Guard”. The site presents a valid TLS certificate issued by Let’s Encrypt (R13), confirming that the server is actively serving HTTPS traffic. The use of a generic DDoS-Guard title is a common tactic to obscure malicious intent and to suggest legitimate protection. Threat intelligence sources have classified the domain as a high‑risk generic phishing site. It is listed on one security blocklist and has been explicitly blocked by the PhishDestroy feed. Automated analysis on VirusTotal recorded a single positive detection out of ninety‑five scanners, and the Gridinsoft trust score is 0 out of 100, indicating a strong malicious reputation. These indicators, combined with the recent creation date, point to a purpose‑built phishing infrastructure. Defenders should add pharmacyonline‑eu.com to deny‑list rules at network perimeter and DNS filtering layers to prevent client connections. Monitoring for outbound connections to the IP 3.71.180.249 and for TLS handshakes using the Let’s Encrypt certificate can provide early detection of compromised hosts. Because the exact phishing payload is not publicly captured, continuous URL and content inspection remains advisable to uncover any credential‑harvesting pages that may be hosted behind the redirect.