theccguydelivery464[.]netlify[.]app

This domain, theccguydelivery464.netlify.app, is actively engaged in a delivery scam operation impersonating The Courier Guy, a recognized logistics brand. The fraudulent site mimics legitimate parcel tracking and delivery notification services to deceive users into submitting personal information or making fraudulent payments. Analysis confirms the domain remains operational as of the latest verification, with no takedown actions implemented despite its malicious classification. Infrastructure analysis reveals the domain is flagged by 18 of 95 security vendors on VirusTotal, indicating widespread detection of its fraudulent nature. The site is hosted on Netlify’s platform and resolves to the IP address 35.157.26.135, which has been associated with other suspicious domains in recent threat intelligence reports. The SSL certificate is issued by DigiCert Inc, a legitimate provider, though this does not mitigate the domain’s malicious intent. No historical registration data is publicly available due to the hosting provider’s policies, limiting further attribution. The page title explicitly references The Courier Guy, reinforcing the brand impersonation tactic. Current status confirms the domain remains active and accessible, posing an ongoing risk to unsuspecting users. Organizations and individuals are advised to block access to this domain at the network level and update endpoint protection rules to include the IP address 35.157.26.135. Users who may have interacted with the site should verify any transactions or shared credentials, particularly those related to delivery confirmations or payment requests. Security teams are encouraged to monitor for additional domains leveraging similar naming conventions or Netlify hosting, as this threat actor may deploy new infrastructure under comparable patterns.