cargo[.]xtransithaulers[.]com

The domain cargo.xtransithaulers.com was registered on June 20, 2025 through Cosmotown, Inc. and is currently offline. Analysis shows it was used for a brand‑impersonation campaign targeting the "across" brand and classified as a crypto scam. The site presented the page title "Cargo X transithaulers - Transport and Logistics," indicating a transport‑logistics theme, but no further page content has been disclosed. Technical fingerprinting reveals a hosting environment on IP address 163.61.188.5, which belongs to AS153568 (NEW DHAKA HARDWARE) and is located in the United States.

The server runs LiteSpeed with HTTP/3 support, and the web stack includes PHP, Bootstrap, Cargo, OWL Carousel, and jQuery. A Let’s Encrypt R12 certificate secured the site, confirming HTTPS availability at the time of capture. DNS resolution used four lytehosting.com nameservers (dns1‑dns4.lytehosting.com). Threat intelligence shows that 14 of 95 VirusTotal scanners flagged the domain, and it appears on one external blocklist.

PhishDestroy has already blocked the domain, and the Gridinsoft trust score is 0 / 100, indicating a high confidence of malicious intent. Uncertainties remain regarding the specific payload or credential‑stealing mechanisms, as no malware samples or detailed page analysis have been released. Defenders should continue to block the IP 163.61.188.5 at the network perimeter, add cargo.xtransithaulers.com to URL filtering and reputation lists, and monitor for any resurgence of the domain or its associated nameservers. Ongoing surveillance of the hosting ASN and related domains is advised to detect potential re‑use of the same infrastructure for future brand‑impersonation or crypto‑related scams.