buy-finasteridepropecia[.]com

This domain, buy-finasteridepropecia.com, is flagged as a high-risk generic_phishing domain based on current intelligence. The domain was created on April 21, 2026, and is currently active, resolving to the IP address 3.71.180.249, which is located in Germany and is associated with AWS EC2 (eu-central-1). The use of a reputable cloud provider does not necessarily indicate benign activity, as malicious actors often leverage legitimate services to host their operations. The domain is registered through Fewmoretaps OU d/b/a Trustname.com, and its nameservers are ares.trustname.com and zeus.trustname.com. The domain's SSL certificate is issued by Let's Encrypt, which is a common choice for both legitimate and malicious sites due to its ease of use and free availability. Analysis indicates that the domain appears on one security blocklist and is blocked by PhishDestroy, suggesting that it has been identified as a potential threat by security researchers. The page title 'DDoS-Guard' is a notable indicator, as DDoS-Guard is often used by malicious sites to obfuscate their true nature and evade detection. The HTTP status code 301 suggests that the domain is being redirected, which could be a technique to mask the final destination of the phishing site. Given the high risk level and the presence of redirection, defenders should be cautious and consider blocking this domain to prevent potential phishing attacks. Additionally, monitoring for any related infrastructure or similar domain names can help in identifying and mitigating broader phishing campaigns. The Gridinsoft trust score of 0/100 further corroborates the high-risk status of the domain, indicating a lack of trust and potential malicious intent. Defenders should also be aware of the domain's resolution to a German IP address, as this could be an attempt to evade geographically-based security controls.