aramexship[.]com[.]everstakebot[.]com

On July 24, 2026 the domain aramexship.com.everstakebot.com was observed as an offline host that had been used for brand impersonation targeting the American Express brand. The domain was registered on May 05, 2025 through Global Domain Group LLC and resolves to the IPv4 address 198.12.66.123, which is hosted by HostPapa (AS36352) in the United States. The authoritative nameservers are ns1.host-forest.com and ns2.host-forest.com, and the site presented a TLS certificate issued by Let\'s Encrypt (R12). The page title returned by the server was "Home | Page", and the site was classified as a crypto scam in the intelligence feed.

Google Safe Browsing flagged the domain for social engineering, and one security blocklist recorded the domain as malicious. VirusTotal reported that three of ninety‑five scanned security vendors flagged the domain, confirming a low but non‑zero detection rate. Additional reputation data shows a Gridinsoft trust score of 0 out of 100, and the domain was blocked by PhishDestroy before being taken offline. The evidence indicates a deliberate attempt to exploit the Amex brand name, likely to lure victims into a cryptocurrency‑related fraud scheme.

Uncertainty remains regarding the exact phishing kit or payload used, as no page content beyond the title has been disclosed. Defenders should continue to block the domain at network perimeters, monitor for any re‑registration attempts, and update detection signatures to include the observed resolver IP, nameserver set, and SSL fingerprint. Ongoing observation of the associated IP range and registrar activity is recommended to pre‑empt potential re‑use of the infrastructure.