instantlasix300[.]com

Analysis shows that instantlasix300.com was registered on April 21, 2026 and resolves to the Cloudflare‑hosted address 188.114.97.3, which is listed as located in CA under CloudFlare, Inc. The site presents a valid Let's Encrypt certificate (E7) and returns HTTP 200 responses. Front‑end inspection reveals a WordPress stack backed by MySQL and PHP, with client‑side libraries including particles.js, Bootstrap, Snap.svg, OWL Carousel and jQuery Migrate. The page title displayed to visitors is “Instant Lasix 300: Negocie com Confiança | Site Oficial”, matching the language used in the phishing lure.

Threat intelligence classifies the domain as a Crypto Drainer, a variant of generic phishing that seeks to extract cryptocurrency assets from victims. The site has been flagged by a single security blocklist and by PhishDestroy, and one of 95 VirusTotal scanners raised an alert. Gridinsoft assigns a trust score of 0 / 100, indicating a high confidence in malicious intent. While the exact payload is not observable from the public page, the combination of a deceptive pharmaceutical‑style title, the use of a reputable SSL certificate, and the underlying WordPress infrastructure suggests a credential‑harvesting front end that may redirect victims to malicious wallet addresses or inject malicious scripts to hijack crypto transactions.

Defenders should immediately block DNS resolution for instantlasix300.com and the associated IP 188.114.97.3 at perimeter filters. Network monitoring should include signatures for the identified WordPress plugins and the specific page title string to detect any attempted access. Organizations should advise users to avoid interacting with unsolicited messages referencing “Instant Lasix 300” and to verify legitimate communications through official channels. Continuous re‑assessment is advised, as the underlying hosting provider (Cloudflare) can obscure origin changes, and additional indicators may emerge if the campaign expands its infrastructure.