buysafepill[.]com

This domain, buysafepill.com, is flagged as a credential theft operation masquerading as a discount online pharmacy. Analysis indicates the site is designed to harvest login credentials, payment details, and personal information from users under the pretense of selling pharmaceutical products. The fraudulent nature is evident from the page title, 'Discount Online Pharmacy - buysafepill.com,' which mimics legitimate pharmacy portals to deceive visitors into entering sensitive data. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 141.98.11.218, which has been linked to prior malicious activity. Detection metrics further confirm its malicious intent, with 7 out of 95 security vendors on VirusTotal flagging the domain. Additionally, the domain appears on one security blocklist and has been documented in a single threat intelligence pulse on AlienVault OTX. The Gridinsoft trust score of 0/100 underscores its lack of legitimacy. Users who visited buysafepill.com should immediately cease all interaction with the site and take corrective measures. Those who entered credentials or financial information should reset passwords for all associated accounts, enable multi-factor authentication where available, and monitor financial statements for unauthorized transactions. System scans using updated security tools are recommended to detect potential malware or backdoors. Network-level blocking of the domain and its associated IP (141.98.11.218) is advised to prevent further exposure. Organizations should update their threat intelligence feeds to include this domain and its indicators of compromise.