cheapdoxycycline[.]info

cheapdoxycycline.info was observed on July 12, 2026 as an active web resource presenting a generic phishing profile. The site returns an HTTP 301 redirect and serves a page whose title reads “DDoS-Guard,” a mismatch that suggests an attempt to disguise malicious content behind a benign‑looking banner. The domain was registered on April 21, 2026, indicating a relatively recent creation date. The domain resolves to the IP address 3.71.180.249, which belongs to an Amazon Web Services EC2 instance in the eu‑central‑1 region (Germany). The authoritative DNS servers are zeus.trustname.com and ares.trustname.com, both linked to the registrar Fewmoretaps OU operating under the trade name Trustname.com. The site presents a Let’s Encrypt R12 TLS certificate, confirming the use of a freely issued HTTPS certificate but providing no additional identity validation. Threat intelligence correlates multiple indicators of compromise. VirusTotal reports that 4 of 95 scanned security engines flag the domain as malicious, and the Gridinsoft trust score is 0 out of 100. The domain appears on one known security blocklist and is explicitly blocked by the PhishDestroy clearinghouse. AlienVault OTX lists the domain in a single pulse, and the page title “DDoS-Guard” does not align with the domain name, further supporting a phishing motive. Given the high risk rating and active status, defenders should block network connections to 3.71.180.249 and add cheapdoxycycline.info to web filtering policies. Monitoring of DNS queries for the associated nameservers may reveal additional malicious replicas. Organizations should warn users about unsolicited communications that reference cheapdoxycycline.info, especially those requesting credential verification or login information, and enforce multi‑factor authentication to mitigate credential harvesting attempts.