expressway-delivery[.]com

Analysis of expressway-delivery.com, created on July 12 2025 and currently active, shows multiple indicators of malicious activity aligned with a delivery‑scam campaign. The domain is registered through OwnRegistrar, Inc. and resolves to IP 216.24.57.7, which is announced by AS 397273 (Render) and geolocated in the United States. The hosting infrastructure is served by nameservers ns1.olitt.com, ns1.olitt.net, ns1.olitt.org, and a placeholder entry “null”, a pattern frequently observed in fast‑flux or disposable hosting setups. HTTP requests return status 200 and the site presents a TLS certificate issued by Let’s Encrypt (YR1), indicating that encryption is in place but does not mitigate the underlying threat.

Reputation services corroborate the risk. Gridinsoft assigns a trust score of 0 / 100, while Scamadviser rates the domain 16 / 100, both reflecting a lack of legitimacy. The domain appears on one external security blocklist and is actively blocked by the PhishDestroy feed. On the open‑source threat‑intel platform AlienVault OTX, the domain is referenced in a single pulse, providing community‑level confirmation of abuse.

VirusTotal scans show that nine out of ninety‑five antivirus engines flag the domain, suggesting that a subset of security products have identified malicious payloads or behavior associated with the site. The page title returned by the server is “expressway delivery – Transport & Logistics Services”, a phrasing that may be used to lure victims into believing the site is a legitimate logistics provider. No additional content analysis is available, and the exact payload or credential‑harvesting mechanisms have not been disclosed publicly. Consequently, the precise tactics employed by the campaign remain uncertain, though the convergence of low trust scores, detection by multiple vendors, and inclusion on blocklists strongly indicates a high‑risk delivery‑scam operation.