buymodafinilrxs[.]org

The domain buymodafinilrxs.org was registered on April 21, 2026 and is currently classified as a high‑risk generic_phishing site. The domain remains active as of the report date (July 12, 2026) and is hosted on a cloud infrastructure that suggests rapid deployment capability. Infrastructure analysis reveals that the domain resolves to the IPv4 address 3.71.180.249, which is located in Germany and belongs to an Amazon Web Services EC2 instance in the eu‑central‑1 region. The authoritative name servers are zeus.trustname.com and ares.trustname.com, both associated with the registrar Fewmoretaps OU d/b/a Trustname.com. The site presents a valid Let's Encrypt certificate (R12) and responded with an HTTP 301 redirect, indicating an intent to forward traffic to a potentially malicious landing page. Gridinsoft assigned a trust score of 0 out of 100, reflecting a lack of confidence in the host's legitimacy. Detection telemetry shows that two of ninety‑five security vendors on VirusTotal flagged the domain, and it appears on a single external blocklist that is actively used by PhishDestroy. The page title observed on the site is “Buy Modafinil Online in Europe – AfinilEU Pharmacy & Lowest Prices,” which aligns with the generic_phishing classification. No additional public intelligence, such as content screenshots or user reports, has been released, leaving the exact payload or credential‑harvesting mechanisms unverified. Defenders should add buymodafinilrxs.org to DNS and proxy blocklists, monitor outbound connections to the resolved IP address, and enforce TLS inspection to detect any subsequent redirects. Continuous re‑evaluation of the domain is advised, as threat actors may alter the hosting provider or certificate while retaining the same registration details. Organizations handling pharmaceutical‑related communications should be especially vigilant given the domain’s targeting language.