aliexpress-usa[.]com

Analysis of aliexpress-usa.com indicates an active brand impersonation campaign targeting the Aliexpress brand. The domain was registered on March 11, 2026 through Global Domain Group LLC and resolves to the IP address 195.123.227.24, which is geolocated to Bulgaria and associated with AS59729 GREEN FLOID LLC. The site presents the page title "Aliexpress USA - Official Site Partner in US Dollars," reinforcing the attempted brand misrepresentation. Infrastructure details include nameservers ns1.h107.hvosting.ua and ns2.h107.hvosting.ua, an SSL certificate issued by Let’s Encrypt (R13), and an MX record pointing to mail.aliexpress-usa.com (priority 10). The domain has a Gridinsoft trust score of 0/100 and is listed on three security blocklists, with blocking observed by PhishDestroy, MetaMask, and SEAL. AlienVault OTX references the domain in eight threat intelligence pulses, and VirusTotal reports 14 out of 94 security vendors flagging it as malicious. The HTTP response returns a 200 status, indicating the site is currently serving content. While the exact phishing landing page has not been examined, the convergence of a brand‑specific page title, low trust score, multiple blocklist appearances, and vendor detections supports a high‑risk classification. Defenders should block the domain at network perimeter and DNS layers, monitor for related email traffic to the listed MX host, and consider adding the IP to threat intelligence feeds. Continuous observation is advised to capture any evolving payloads or additional infrastructure tied to this campaign.