ukmodafinil[.]org

This domain, ukmodafinil.org, is flagged as a credential theft operation targeting users through fraudulent pharmaceutical offers. Analysis indicates no direct association with a known drainer kit or cryptocurrency wallet exfiltration, but the site employs deceptive login portals to harvest user credentials. The infrastructure mimics legitimate online pharmacies, leveraging brand impersonation to lower user vigilance and increase conversion rates. Infrastructure analysis reveals the domain was registered on April 28, 2026, through Fewmoretaps OU d/b/a Trustname.com. It resolves to the IP address 31.184.236.235 and utilizes a Let's Encrypt SSL certificate to appear legitimate. Detection metrics show 3 out of 95 security vendors on VirusTotal have flagged the domain, while it appears on one additional security blocklist. Google Safe Browsing does not currently list the domain, though this may reflect a lag in propagation rather than absence of risk. The domain is currently offline, likely due to takedown actions or infrastructure suspension. It was blocked by PhishDestroy, suggesting proactive mitigation efforts. Despite its inactive status, residual risk remains for users who may have interacted with the site prior to its removal. Organizations are advised to update web filters, monitor for credential reuse attempts, and educate users on recognizing brand impersonation tactics in pharmaceutical-themed phishing campaigns.