AliExpress

E-commerce & retail Chinaaliexpress.comRank 462 of the most impersonated
Cert findings · 24 h
2
Cert findings · 7 days
4
4 on phishing hosts
Registered lookalikes
249
33 listed by a source or an address list
Official domains
9
verified from AliExpress's own sites and records

Certificate findings for AliExpress

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to AliExpress's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 7 findings, grouped by hostname

  1. aliexpress-shipping.ph NL · AS43350 · NFORCE NForce Entertainment…2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    aliexpress-shipping.ph
    First seen
    2026-11-05 09:04 UTC
    First published
    2026-10-28 06:38 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 212.92.105.199.
    1. Phishing-host list fetched with the address
    2. Resolved to 212.92.105.199
    Brand
    AliExpress
    Addresses
    212.92.105.199 · Netherlands · AS43350 NFORCE NForce Entertainment B.V.
    172.93.103.99 · United States · AS23470 RELIABLESITE - ReliableSite.Net LLC
    Domain
    aliexpress-shipping.ph
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

  2. www.aliexpress.com.ee EE · AS49604 · ZONE Zone Media OU
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.aliexpress.com.ee
    First seen
    2026-11-05 00:41 UTC
    First published
    2026-11-05 01:50 UTC
    DNS
    Resolves · checked 2026-11-05 02:00 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.31.240.240.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.31.240.240
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-04 23:36 UTC to 2027-02-02 23:36 UTC
    Logged 2026-11-05 00:35 UTC in Google PlumbersArms2027h1, entry 617,612,190
    SHA-256 18c62bf3409447ca6f505cb1871c8e9e6644f1cd31e1d692827758e1e2dda509
    Public key SHA-256 e318ff435a249b30068344e5b0d2667fe577a29ad80d8a14c8202fc53a7a0a9c
    Brand
    AliExpress
    Addresses
    185.31.240.240 · Estonia · AS49604 ZONE Zone Media OU
    Domain
    aliexpress.com.ee
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  3. aliexpress.com.ee EE · AS49604 · ZONE Zone Media OU
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    aliexpress.com.ee
    First seen
    2026-11-03 16:00 UTC
    First published
    2026-11-03 16:45 UTC
    DNS
    Resolves · checked 2026-11-04 16:55 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.31.240.240.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.31.240.240
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-03 14:59 UTC to 2027-02-01 14:59 UTC
    Logged 2026-11-03 15:57 UTC in Let's Encrypt Willow2027h1, entry 916,284,934
    SHA-256 8de903f787ea60144c36dfb3f2ea6ae39a9aa7eebe0c66c0f59546bc8c57f90a
    Public key SHA-256 d11b8ff72bc8e9495a919ed9675dcfc3643b945f806a271938c2d423502547c7
    Brand
    AliExpress
    Addresses
    185.31.240.240 · Estonia · AS49604 ZONE Zone Media OU
    Domain
    aliexpress.com.ee
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  4. aliexpress-profit.xyz GB · AS52148 · ENIXLTD Enix Ltd
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC policy noneRegistered 4 mo ago
    DetailsHide
    Hostname
    aliexpress-profit.xyz
    First seen
    2026-10-30 13:56 UTC
    First published
    2026-10-30 14:56 UTC
    DNS
    Resolves · checked 2026-11-04 15:03 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.73.9.3.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.73.9.3
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-10-30 12:54 UTC to 2027-01-28 12:54 UTC
    Logged 2026-10-30 13:53 UTC in Google ParcelYard2027h1, entry 523,432,081
    SHA-256 edd35a2fbb11d82f6ad2ca1a3460fbd3393085193834235871d14f6875bfed7a
    Public key SHA-256 fece72af3593307ba5570d4f6a5434a95e6e9a52a5015640bbcc0f2c44ee2714
    Brand
    AliExpress
    Addresses
    185.73.9.3 · United Kingdom · AS52148 ENIXLTD Enix Ltd
    Domain
    aliexpress-profit.xyz
    Registered
    2026-06-25 · Dynadot Inc
    MX
    Receives mail at aliexpress-profit.xyz
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 23:57 UTC

    Suggest a correction

  5. en-us-aliexpress.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 9 mo ago
    DetailsHide
    Hostname
    en-us-aliexpress.com
    First seen
    2026-10-27 14:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-10-30 · checked 2026-11-05 08:59 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. We matched its certificate name
    3. Latest DNS check
    Certificate
    Logged in Let's Encrypt Willow2027h1, entry 798,265,131
    SHA-256 0ab195d961e4a27a025ef4d290e01cb7247d38d8ba450bacdf0037fcd3cab811
    Brand
    AliExpress
    Addresses
    104.21.29.120 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.148.250 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:1d78
    2606:4700:3034::ac43:94fa
    Cloudflare
    Cloudflare (104.21.29.120, 172.67.148.250): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    en-us-aliexpress.com
    Registered
    2026-02-20 · Register SPA
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:31 UTC

    Suggest a correction

  6. www.aliexpressinvoice.store SE · AS39570 · LOOPIA Loopia AB
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missingRegistered 5 y ago
    DetailsHide
    Hostname
    www.aliexpressinvoice.store
    First seen
    2026-10-27 00:27 UTC
    DNS
    Resolves · checked 2026-11-05 09:05 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 93.188.2.52.
    1. Phishing-host list fetched with the address
    2. Resolved to 93.188.2.52
    3. Latest DNS check
    Certificate
    Logged in DigiCert Wyvern2027h1, entry 318,606,016
    SHA-256 44b729b7c312c2a72e2169715dd91e7a08079f95cfed6572dbdd05b7f7d1d5f8
    Brand
    AliExpress
    Addresses
    93.188.2.52 · Sweden · AS39570 LOOPIA Loopia AB
    Domain
    aliexpressinvoice.store
    Registered
    2021-12-31 · Ascio Technologies, Inc. Danmark - Filial af Ascio technologies, Inc. USA
    MX
    Receives mail at mailcluster.loopia.se, mail2.loopia.se
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:26 UTC

    Suggest a correction

  7. aliexpressinvoice.store SE · AS39570 · LOOPIA Loopia AB
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missingRegistered 5 y ago
    DetailsHide
    Hostname
    aliexpressinvoice.store
    First seen
    2026-10-27 00:16 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 93.188.2.52.
    1. Phishing-host list fetched with the address
    2. Resolved to 93.188.2.52
    3. Latest DNS check
    Certificate
    Logged in IPng Networks Halloumi2027h1, entry 273,605,701
    SHA-256 5fc41b7d561ecb03578b949b99896db25efe8cc99952d5f8ad79f0c636d634dd
    Brand
    AliExpress
    Addresses
    93.188.2.52 · Sweden · AS39570 LOOPIA Loopia AB
    Domain
    aliexpressinvoice.store
    Registered
    2021-12-31 · Ascio Technologies, Inc. Danmark - Filial af Ascio technologies, Inc. USA
    MX
    Receives mail at mailcluster.loopia.se, mail2.loopia.se
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:26 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches AliExpress when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in E-commerce & retail

All brands →