aramexship[.]com

This domain, aramexship.com, was registered on May 05, 2025 through Global Domain Group LLC and currently resolves to the IP address 198.12.66.123 hosted by HostPapa (ASN 36352) in the United States. The authoritative name servers are ns1.host-forest.com and ns2.host-forest.com, and the zone publishes an MX record pointing to webmail.aramexship.com. The site presents an SSL certificate issued by Let’s Encrypt (R12), indicating that HTTPS is available but does not provide any brand‑authenticated validation. Reputation services assign a Scamadviser trust score of 31 / 100 and a Gridinsoft score of 0 / 100, both reflecting a high likelihood of malicious activity.

Google Safe Browsing flags the domain for social engineering, and PhishDestroy has added it to its blocklist; overall the domain appears on one external security blocklist. VirusTotal analysis shows that eleven of ninety‑five scanned scanners label the domain as malicious, corroborating the other indicators. The page title returned by the web server is “Home | Page”, which offers no further insight into the content. The campaign targets the American Express brand, as indicated by the “brand target” field, and is classified as a brand‑impersonation scam.

The site is presently taken offline, limiting immediate exposure, but the infrastructure – including the hosting provider, name server configuration, and SSL setup – remains reusable for future campaigns. Defenders should add the domain and its associated IP address to local blocklists, monitor the hosting ASN for similar activity, and consider extending detection rules to capture any resurgence of the same name‑server pair or MX record pattern. Ongoing vigilance is advised because the underlying hosting environment is public and could be leveraged to host new malicious sites without further registration changes.