housepharmacy[.]net

PhishDestroy analysts have flagged housepharmacy.net as an active credential theft domain designed to harvest user login credentials under the guise of a legitimate pharmacy service. This domain employs brand impersonation tactics to deceive users into submitting sensitive account information, likely targeting customers of well-known pharmacy chains or health services. No evidence of a crypto drainer kit or advanced malware payload has been detected during initial analysis, suggesting a focus on credential harvesting rather than direct financial asset exfiltration.

Technical indicators reveal a high-risk profile: the domain resolves to IP 3.71.180.249, operates with a Let's Encrypt SSL certificate, and was registered through Fewmoretaps OU (d/b/a Trustname.com) on July 24, 2025. VirusTotal currently reports 1/95 detections, indicating that traditional security tools have not yet flagged this infrastructure. While Google Safe Browsing (GSB) status and third-party blocklist counts remain unverified, the domain’s recent creation and low detection rate suggest it is actively evading detection mechanisms.

The domain remains active as of the latest assessment, with no confirmed takedown or mitigation actions observed. PhishDestroy advises immediate avoidance of housepharmacy.net and urges users who may have interacted with the site to change passwords and enable multi-factor authentication on all related accounts. Organizations should block the domain and associated IP at the network perimeter to prevent further exploitation. The remaining risk is classified as under investigation, pending deeper forensic analysis and potential law enforcement engagement.