expresssureexcrow[.]co[.]uk

The domain expresssureexcrow.co.uk was registered on September 14, 2025 and is currently classified as a high‑risk, active brand‑impersonation campaign. Its page title claims to represent a global shipping and logistics provider, indicating a credential‑phishing intent aimed at a broad set of victims. The domain appears on a single security blocklist and has been referenced in one AlienVault OTX pulse, confirming its presence in threat‑intel feeds.

Infrastructure analysis shows the domain resolves to IP address 198.12.80.250, which is hosted in the United States under AS36352 operated by HostPapa. Registration was performed through Realtime Register BV trading as Axidomains, and the authoritative nameservers are ns1.coreserverhost.com and ns2.coreserverhost.com. The site serves content over HTTPS using a Let's Encrypt R12 certificate, and an HTTP request returns a 403 status code, suggesting restricted access to the underlying page. Apache HTTP Server is identified as the web server technology.

Reputation metrics are extremely low: Scamadviser assigns a trust score of 1 / 100 and Gridinsoft a score of 0 / 100. VirusTotal analysis recorded 2 detections out of 95 scanning engines, indicating limited but existent malware or phishing indicators. The domain has been actively blocked by PhishDestroy, reinforcing its recognition by commercial mitigation services. These data points collectively support the conclusion that the domain is being leveraged for credential harvesting under the guise of a logistics service.

Defenders should add the domain and its resolving IP to blocklists across perimeter and endpoint solutions, and monitor DNS queries for the associated nameservers. Given the low reputation scores and existing blocklist entries, automated sinkholing of the IP range is advisable. Continuous probing of the domain for changes in HTTP response or additional malware signatures will help maintain situational awareness as the campaign evolves.