propecia-finasteride-generic[.]org

This domain is flagged for elevated risk due to credential theft phishing activity targeting users of pharmaceutical brands. Analysis indicates the site was designed to harvest login credentials, payment details, and personally identifiable information under the guise of legitimate medical product offerings. The infrastructure exhibits multiple high-risk indicators consistent with organized phishing operations. Infrastructure analysis reveals the domain propecia-finasteride-generic.org was registered through Fewmoretaps OU d/b/a Trustname.com on April 21, 2026, and resolves to IP address 3.71.180.249. VirusTotal detection shows 7 out of 95 security vendors flagging the domain as malicious. It appears on one security blocklist and was previously listed in one AlienVault OTX threat intelligence pulse. The domain holds a Gridinsoft trust score of 0/100 and was blocked by PhishDestroy. The page title displayed 'DDoS-Guard' and used a Let's Encrypt SSL certificate. Current status indicates the domain has been taken offline. Mitigation steps for credential theft phishing require immediate action from affected organizations and users. Network administrators should implement DNS sinkholing for 3.71.180.249 and add the domain to web proxy blocklists. Security teams must conduct password resets for any accounts accessed during the domain's active period, particularly for credentials associated with medical or financial services. Users should enable multi-factor authentication on all critical accounts and verify any communications claiming to be from pharmaceutical brands through official channels only. Organizations should monitor for unusual authentication attempts and implement enhanced logging for credential access patterns.