theccguydeliveries[.]netlify[.]app

On July 23, 2026, the domain theccguydeliveries.netlify.app was observed hosting a brand‑impersonation page titled “The Courier Guy”. The site was registered on March 6, 2026 through Netlify, a known static‑site hosting provider, and resolves to the IP address 18.208.88.157, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in Germany. The TLS certificate presented is a DigiCert Global G2 RSA SHA256 2020 CA1 chain issued by DigiCert Inc., indicating a valid, publicly trusted certificate. An HTTP request to the root returned a 404 status, suggesting the page is no longer available; the domain is currently listed as offline.

Reputation data shows the domain appears on a single security blocklist, PhishDestroy, and is flagged by Google Safe Browsing for social‑engineering content. VirusTotal analysis recorded 22 detections out of 94 scanned vendors, reinforcing the malicious classification. The Gridinsoft trust score is 0 out of 100, aligning with the other indicators of compromise. No additional malware‑hosting or command‑and‑control infrastructure has been disclosed.

Evidence points to a classic brand‑impersonation campaign targeting users of The Courier Guy, leveraging a legitimate hosting service to obtain a trusted SSL certificate and thereby increase credibility. The precise content of the page has not been captured, and the short lifespan (creation to takedown within a few months) limits forensic detail. Defenders should update URL filtering rules to block the full hostname and any sub‑domains, enforce safe‑browsing warnings for the domain, and monitor for similar Netlify‑hosted domains that resolve to the same Amazon AS. Incident response teams should also consider the possibility of credential‑harvesting or payment‑redirection vectors associated with the brand, and advise users to verify official communications through known channels.