genpucoserv[.]com

The domain genpucoserv.com was registered on May 19, 2025 through OwnRegistrar, Inc. and currently resolves to the IPv4 address 192.3.190.186, which is hosted in the United States under ASN 36352 owned by HostPapa. The authoritative name servers listed for the zone are dns1.webproserver.com and dns2.webproserver.com, with a third entry recorded as null. No TLS certificate is presented for the site, indicating that it serves content only over plain HTTP. The web server stack identified includes LiteSpeed with support for HTTP/3, suggesting a relatively modern configuration despite the lack of encryption.

The page title returned from the site is "G.P.S COURIER COMPANY - COURIER", and the threat intelligence record classifies the content as a brand‑impersonation campaign targeting the brand "across". Gridinsoft assigned a trust score of 0 out of 100, reflecting a high likelihood of malicious intent. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service, which aligns with its current offline status.

VirusTotal analysis shows that one out of ninety‑five scanning engines flagged the domain, providing at least one independent detection of malicious activity. No SSL/TLS certificate, combined with the low trust score and blocklist presence, further corroborates the assessment that the domain was used for phishing or credential harvesting.

Uncertainties remain regarding the specific payload or phishing kit employed, as no additional forensic artifacts or landing‑page screenshots have been released. Defenders should continue to monitor DNS queries for genpucoserv.com and its associated name servers, enforce blocklists that include this domain, and ensure that any outbound traffic to the IP 192.3.190.186 is denied.