propecia-finasteride-5mg[.]net

Analysis of propecia-finasteride-5mg.net indicates a high-risk phishing domain targeting pharmaceutical consumers. The domain, registered on April 21, 2026, through Fewmoretaps OU (operating as Trustname.com), currently resolves to IP 3.71.180.249, hosted on AWS EC2 in Frankfurt, Germany. The infrastructure uses nameservers ares.trustname.com and zeus.trustname.com, a pattern observed in other fraudulent operations. A 301 HTTP redirect suggests the site may funnel visitors to another malicious endpoint, though the destination remains unconfirmed. The page title 'DDoS-Guard' is anomalous for a pharmaceutical domain and likely indicates a front for protective services masking illicit activity. A Let's Encrypt SSL certificate (R12) provides HTTPS encryption, a common tactic to appear legitimate. The domain appears on one security blocklist and has been flagged by a single vendor in threat intelligence feeds, though no specific phishing kit or brand impersonation details are available from current data. Defenders should treat this domain as active and malicious. The combination of a newly registered domain, pharmaceutical keywords, and DDoS-Guard branding strongly suggests a fake online pharmacy operation. Network-level blocking is recommended, and security teams should monitor for related domains using the same registrar or hosting infrastructure.