carrierexpressdelivery[.]com[.]octa-trade[.]uk

The domain carrierexpressdelivery.com.octa-trade.uk was created on January 30, 2025 and is presently taken offline. Registration records show the domain was provisioned through 1api GmbH, a registrar identified by the tag 1API-DE. The public page title returned by the site was "Carrier Express Delivery," which does not reference the targeted brand but the infrastructure is linked to a Google brand impersonation campaign, as indicated by the threat classification. DNS resolution points to the IPv4 address 198.12.66.123, hosted in the United States under autonomous system AS36352 owned by HostPapa.

The authoritative nameservers are ns1.host-forest.com and ns2.host-forest.com. No TLS certificate was observed, meaning the site operated without HTTPS encryption. Reputation scoring is extremely low: Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has already blocked the domain, and VirusTotal reported a single detection out of ninety‑five scanning engines, reinforcing the suspicion of malicious intent.

The elevated risk rating reflects the brand impersonation of Google, despite the limited observable content. Defenders should ensure the domain is added to local and network‑level blocklists, monitor the hosting IP and associated AS for any future activity, and watch for new registrations through the same registrar that may reuse similar naming patterns. Continuous observation of the nameserver domain host-forest.com is also advised, as it could host additional fraudulent sites. Since the site is offline, further forensic collection is not possible at this time, but the documented indicators provide a clear basis for proactive mitigation.