doxycyclineonline[.]info

Analysis of doxycyclineonline.info shows a newly registered domain (created 21 April 2026) that resolves to the AWS EC2 address 3.71.180.249 in the eu‑central‑1 region of Germany. The site presents a page title of "DDoS‑Guard" and serves a TLS certificate from Let’s Encrypt (R13). DNS is delegated to zeus.trustname.com and ares.trustname.com, matching the registrar Fewmoretaps OU d/b/a Trustname.com. An HTTP request returns status 403, indicating that direct access is currently denied, but the presence of a valid certificate and active name servers suggests the infrastructure remains operational. The domain has a Gridinsoft trust score of 0 / 100 and is listed on at least one security blocklist, with PhishDestroy confirming active blocking. Threat intelligence from AlienVault OTX references the domain in a single pulse, and VirusTotal reports 11 of 94 scanners flagging it as malicious. While the exact phishing payload or target audience has not been publicly observed, the combination of a recent registration, low trust rating, multiple vendor detections, and blocklist inclusion points to a high‑risk phishing operation. Defenders should add doxycyclineonline.info to deny‑list policies, monitor DNS queries for the associated IP, and consider sinkholing or traffic redirection to mitigate potential credential harvesting attempts.