pharmahubbd[.]com

Analysis indicates that pharmahubbd.com is currently active and associated with a high‑risk generic phishing operation. The domain was created on 13 November 2024 and registered through TuringSign Inc. d/b/a Cosmotown. It resolves to the IPv4 address 103.65.138.102 and is hosted without an SSL certificate, which is consistent with many malicious sites designed to avoid encrypted traffic inspection. Authoritative nameservers are psbd3.hostseba.com and psbd4.hostseba.com. VirusTotal records show that 7 of 91 scanners flagged the domain, and AlienVault OTX lists it in six separate threat intelligence pulses, providing multiple independent confirmations of malicious use. The MX record is configured to direct mail to pharmahubbd.com itself, a configuration frequently observed in credential‑harvesting infrastructures. No additional technical artifacts such as command‑and‑control endpoints, download URLs, or observed payload hashes have been disclosed, leaving the exact phishing content undefined. Defenders should prioritize blocking the domain at the DNS and web‑proxy layers, incorporate the IP address 103.65.138.102 into network‑level deny lists, and monitor email gateways for any messages that reference the domain or its mail server. Ongoing threat‑intel feeds should be checked for new indicators, and incident response teams should be prepared to contain potential credential theft if related traffic is detected.