edexpressboxs[.]xyz

edexpressboxs.xyz is an active domain flagged for brand impersonation targeting a wide audience. The site was registered on 16 June 2025 through OwnRegistrar, Inc. and is hosted on an IP address 192.3.190.186 owned by AS36352 HostPapa in the United States. DNS resolution uses the authoritative servers dns1.webproserver.com and dns2.webproserver.com. The web server returns HTTP 200 and presents an SSL certificate issued by Let’s Encrypt (YR1), indicating encrypted transport. The page title returned by the server is “FED Express Delivery”, matching the listed scam type of a shipping scam. VirusTotal analysis shows three of ninety‑five scanners flag the domain as malicious. Additional security telemetry records a Gridinsoft trust score of 0 out of 100 and placement on a single blocklist, while PhishDestroy currently blocks the domain. The limited detection count and low trust score suggest a high‑risk profile despite the modest blocklist presence. Current intelligence does not disclose the precise phishing kit or credential harvesting mechanisms employed. Defenders should add the domain to URL filtering rules, monitor DNS queries for the associated nameservers, and enforce blocking at perimeter and endpoint security layers. Ongoing observation of any changes to the SSL certificate, hosting provider, or detection counts is advised to capture potential escalation.