casgaexpress[.]com

On 24 July 2026 analysts observed that the domain casgaexpress.com was registered through Dynadot LLC on 3 October 2025. The site resolves to the IPv4 address 198.251.88.162, which is announced by AS53667 (FranTech Solutions) and geolocated to the United States. Authoritative name servers listed for the domain include ns1.asurahosting.com, ns2.asurahosting.com, ns1.my-control-panel.com and ns2.my-control-panel.com, indicating use of a shared hosting environment. The domain presents a TLS certificate issued by Let’s Encrypt (R13) and returns an HTTP 302 redirect when accessed, suggesting a possible redirect chain to malicious content.

The page title returned by the server is “Casgaexpress | Tracking, Track Parcels, Packages, Shipments | Casgaexpress Express Tracking”, which does not reference the targeted brand but the infrastructure is confirmed to impersonate Google according to intelligence reports. VirusTotal scans have resulted in two of ninety‑five security vendors flagging the domain, and Gridinsoft assigns a trust score of zero out of one hundred, reflecting a high likelihood of malicious intent. The IP address appears on a single security blocklist and the domain is actively blocked by PhishDestroy, reinforcing the classification as a high‑risk asset. Technology fingerprints show the presence of PHP, Bootstrap, LiteSpeed, OWL Carousel, jQuery, GetButton and HTTP/3, a stack commonly observed in phishing kits.

An MX record with priority zero points to the same domain, which may be used for credential harvesting or spam distribution. Given the combination of recent registration, low trust scores, vendor detections, active blocklist listings, and the explicit claim of Google impersonation, defenders should treat casgaexpress.com as a high‑confidence phishing indicator.