ivermectina[.]org

This domain, ivermectina.org, is identified as a credential theft infrastructure targeting users seeking pharmaceutical products, particularly those related to ivermectin. Analysis indicates the site is designed to mimic legitimate medical or supplement retailers, tricking victims into entering sensitive login or payment information. No specific drainer kit or cryptocurrency wallet association has been confirmed, but the domain’s structure and content align with credential harvesting tactics commonly used in fake online pharmacies. Infrastructure analysis reveals the domain was registered on April 24, 2026, through Fewmoretaps OU d/b/a Trustname.com. It resolves to the IP address 3.71.180.249 and is currently flagged by 4 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and has a Gridinsoft trust score of 0/100, indicating high suspicion. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious domains. AlienVault OTX records the domain in one threat intelligence pulse, further corroborating its malicious classification. The domain is currently offline, having been taken down following detection by automated systems. Despite its inactive status, residual risk persists due to potential reuse of the infrastructure or registration of similar domains by the same threat actor. Users who may have interacted with the site are advised to monitor for unauthorized access to accounts, particularly those linked to medical or financial services. Organizations should update blocklists to include this domain and its associated IP to prevent future exposure.