all-med-rx[.]com

All-med-rx.com was observed hosting a site whose HTML title is “Canadian Pharmacy”. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and uses Cloudflare authoritative name servers simone.ns.cloudflare.com and uriah.ns.cloudflare.com. DNS resolution points to IP 51.38.142.171, an address owned by AS16276 OVH SAS located in Poland. No TLS certificate is presented, indicating the site is served over plain HTTP. The page has been classified as a social‑media phishing campaign and appears on a single security blocklist; it is also listed by PhishDestroy as blocked. VirusTotal reports that 14 of 93 scanning engines flag the domain as malicious, reinforcing the suspicion of abuse.

Scamadviser assigns a trust score of 1/100, reflecting an extremely low reputation. Current monitoring shows the domain is offline as of the report date, July 23, 2026. Analysis indicates that the infrastructure—registration via a known registrar, Cloudflare DNS, and hosting on an OVH SAS address—matches patterns commonly seen in phishing operations that leverage reputable DNS providers to evade simple blacklist checks. The lack of an SSL certificate further reduces the credibility of the site and may be used to lure victims through HTTP links posted on social platforms. While the page title suggests the lure is a “Canadian Pharmacy”, no additional content has been captured, leaving the exact phishing vector unconfirmed.

Defenders should block the domain at network perimeter and add the IP address 51.38.142.171 to deny‑list rules. Security solutions that integrate VirusTotal scores can continue to flag the domain based on the 14 positive detections. Monitoring of the registrar NiceNIC International Group Co., Limited for future registrations may help identify related campaigns. Since the site is presently offline, ongoing surveillance is recommended to detect any re‑activation or migration to new hosts.