galaxysecurityservice[.]org[.]parceltracx[.]org

Analysis of galaxysecurityservice.org.parceltracx.org shows a recently registered domain created on December 27, 2024 and provisioned through NameCheap, Inc. The zone is configured with authoritative nameservers ns1.parceltracx.org and ns2.parceltracx.org, and it resolves to the IPv4 address 198.12.80.250, which is assigned to AS36352 (HostPapa) in the United States. No TLS certificate is presented, indicating the site operates without HTTPS protection. The only publicly observed page title is "Package tracking with tracking number," a generic phrase that does not reference the targeted brand.

However, intelligence flags the domain as an Aliexpress impersonation, and the threat type is recorded as brand impersonation. VirusTotal scans have returned detections from 10 of 95 security vendors, and the domain appears on at least one security blocklist. Independent filtering services such as PhishDestroy have already blocked the host, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment.

The site is currently offline, limiting immediate interaction, but its infrastructure—shared hosting under HostPapa and a lack of SSL—suggests a low‑cost, disposable setup typical of phishing campaigns. Defenders should continue to monitor the IP 198.12.80.250 for any re‑activation, incorporate the domain and its IP into blocklists, and enforce outbound filtering for traffic to unknown tracking‑related URLs. Additional verification of any future content should focus on the presence of Aliexpress branding or credential‑capture forms, as the existing evidence does not reveal the exact phishing payload.