airglobaltrack[.]delivery

Analysis of airglobaltrack.delivery as of July 23, 2026 indicates that the domain is actively operated and is being used for a brand‑impersonation crypto‑scam targeting the “across” brand. The site returns HTTP status code 520, which often reflects a Cloudflare‑originated error page, and the TLS certificate is issued by Google Trust Services under the WE1 certificate authority, confirming the presence of HTTPS. The underlying infrastructure is hosted in the United States by HostPapa (ASN 36352) and resolves to IP 198.23.193.170. Nameservers ns1.geebytescloud.com and ns2.geebytescloud.com resolve the domain, and the observed web stack includes Bootstrap, jQuery, Popper, Cloudflare Browser Insights, and HTTP/3 support, suggesting a modern but generic site template. Reputation services flag the domain as highly malicious.

VirusTotal reports that 12 of 95 scanning engines have flagged the domain, and Google Safe Browsing classifies it as a social‑engineering threat. Gridinsoft assigns a trust score of 0 out of 100, while Scamadviser rates it 1 out of 100. The domain appears on at least one public blocklist and has been added to PhishDestroy’s blocklist, indicating that some defensive feeds already block traffic to it. AlienVault OTX lists the domain in a single threat‑intelligence pulse, reinforcing its association with malicious activity. The limited public information does not reveal the exact landing page content, login forms, or payload delivery mechanisms, so the full attack vector remains uncertain.

However, the combination of brand impersonation, the “Crypto Scam” classification, and the low trust scores strongly suggests that the site is likely attempting to lure victims into transferring cryptocurrency or divulging credentials under the guise of the across brand. Defenders should block the domain at the DNS and proxy layers, enforce TLS inspection to detect the Google Trust Services certificate, and monitor outbound traffic to the IP 198.23.193.