buyxarmodafinil[.]org

Analysis of the domain buyxarmodafinil.org, created on 19 January 2025 and hosted at IP 3.71.180.249, indicates an active generic phishing infrastructure. The domain is registered through Fewmoretaps OU d/b/a Trustname.com and uses the nameservers ares.trustname.com, zeus.trustname.com, ns1.anycastdns.cz and ns2.anycastdns.cz, a configuration commonly observed in malicious campaigns that leverage reputable DNS providers to increase perceived legitimacy. VirusTotal scans have flagged the domain in 4 of 91 security vendor engines, demonstrating that automated detection tools have identified suspicious characteristics.

The domain is listed on one public security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the consensus that the site is being used for phishing. The elevated risk rating reflects the combination of recent registration, dedicated hosting, and detection evidence. No public page title, SSL certificate details, or HTTP response codes have been disclosed, leaving the exact content and credential‑collection mechanisms unverified.

Defenders should add buyxarmodafinil.org and its resolving IP address to network‑level blocklists, monitor DNS queries for the associated nameservers, and consider sharing the indicator set with threat‑intel peers. Continuous re‑scanning of the domain on VirusTotal and periodic WHOIS checks are recommended to capture any changes in detection status or hosting infrastructure.