desireexpress[.]ng

Analysis of desireexpress.ng, observed as of July 22 2026, shows that the domain is currently offline but retains indicators of a brand‑impersonation campaign targeting Google. The domain was registered on 3 March 2025 through HostAfrica and resolves to the IPv4 address 107.173.193.235, which is hosted by AS36352 (HostPapa) in the United States. Nameserver records point to ns6.elitecloudserver.com and ns5.elitecloudserver.com, and the MX record is configured with priority 0 pointing to desireexpress.ng, suggesting intent to receive email traffic. No TLS certificate is presented, meaning the site would have been served over HTTP only, a common characteristic of low‑cost phishing infrastructure. VirusTotal reports indicate that 2 of 95 scanning engines flagged the domain, and it appears on a single external blocklist, confirming that at least some security products have identified it as malicious.

The page title returned from the server is “Desire Express Company | Homepage”, which does not reference the impersonated brand, but the intelligence explicitly labels the campaign as impersonating Google. The domain has been blocked by the PhishDestroy sinkhole, reinforcing the conclusion that it was part of an active phishing operation. Uncertainty remains regarding the specific phishing kit or payload used, as no sample URLs or login pages have been disclosed, and the lack of an SSL certificate prevents verification of any credential‑harvesting mechanisms. Additionally, because the site is offline, real‑time verification of content is impossible, limiting the ability to assess current threat behavior.

Defenders should continue to monitor DNS queries for the IP address 107.173.193.235 and the associated nameservers, as the infrastructure may be repurposed for new campaigns. Blocking the domain at the firewall or proxy level, adding the IP to threat‑intelligence feeds, and ensuring that email filters reject messages originating from the MX record are recommended.