express-checkout[.]com

PhishDestroy identifies express-checkout.com as an active generic phishing domain posing as a legitimate checkout portal to harvest credit card and login credentials. The threat is immediate: users attempting to complete purchases may unknowingly submit sensitive payment information to attacker-controlled infrastructure. This domain was flagged under seed a4e07e and remains unlisted on major blocklists despite its recent creation and suspicious SSL provenance. This domain was registered on November 26, 2025 through Squarespace Domains LLC and resolves to IP address 3.139.243.146. VirusTotal scanning shows 0 detections out of 95 engines as of the latest scan. The SSL certificate is issued by Amazon, which may lend an air of legitimacy but does not validate the domain’s authenticity given its recent registration and lack of brand association. No current listings were found on Google Safe Browsing, PhishTank, OpenPhish, or URLVoid as of the seed timestamp. WHOIS data conceals registrant details behind privacy protection, a common tactic in malicious domain registration. To mitigate exposure, users should avoid visiting express-checkout.com and should verify any checkout URLs directly with the intended merchant via official channels. Organizations are advised to block the domain at DNS and firewall levels and inspect network traffic for connections to 3.139.243.146. Security teams should monitor for downstream compromise, including credential reuse from stolen data, and update threat intelligence feeds with this IOC (a4e07e seed) to protect customers and employees. Given the absence of AV detections, behavioral analysis and domain age heuristics are critical in early detection and prevention.