go-delivery-marmitex[.]shop

Analysis of go-delivery-marmitex.shop, observed on 23 July 2026, indicates that the domain is associated with a delivery‑scam campaign. The domain is registered through Dynadot Inc. and uses the authoritative nameservers ns1.dyna-ns.net and ns2.dyna-ns.net. DNS resolution points to the IPv4 address 88.80.17.179, which is attributed to a PRQ Dynvpn hosting environment in Sweden (SE). The hosting provider does not publish a dedicated ASN, but the location suggests the infrastructure is operated from a VPN service commonly abused for malicious traffic.

The site presented a TLS certificate from Let’s Encrypt (certificate type YR1) that was valid at the time of capture, confirming that HTTPS was enabled. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on one external security blocklist, indicating that at least one security organization has flagged it. VirusTotal scans reported that eight out of ninety‑one antivirus engines flagged the domain, reinforcing the suspicion of malicious activity. The page title returned by the HTTP response was “ZE Express | Bebidas geladas”, a phrase that does not correspond to the advertised delivery service and may be used to lure Portuguese‑speaking victims.

The domain has been taken offline, and PhishDestroy currently lists it as blocked. No public evidence of the underlying phishing kit or specific payloads was observed, and the content of the landing page beyond the title has not been captured. Defenders should therefore treat the domain as high‑confidence malicious, add the FQDN and its resolving IP address to network‑level deny lists, monitor DNS queries for the associated nameservers, and continue to watch for re‑registration or the emergence of similar domains using the same hosting profile. Ongoing threat‑intel collection should include periodic re‑resolution of the IP, correlation with any new VirusTotal submissions, and verification against additional blocklist feeds.