order-thecourierguy[.]netlify[.]app

This domain is flagged for generic phishing activity targeting users of courier and delivery services. Analysis indicates an elevated risk level due to its impersonation of legitimate logistics platforms, likely designed to harvest login credentials, payment details, or personal information through fraudulent forms or redirects. The threat type is classified as credential theft and financial fraud, with a focus on exploiting trust in delivery service branding. Infrastructure analysis reveals the domain order-thecourierguy.netlify.app was registered on February 27, 2026, through Netlify, a platform commonly abused for hosting phishing pages. It resolves to IP address 35.157.26.135, located in Germany under AS16509 (Amazon.com, Inc.). The SSL certificate is issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), a legitimate provider often leveraged to lend false credibility. Detection metrics show 18 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one security blocklist. The page currently returns a 'Site not found' error, suggesting takedown or temporary suspension, but historical activity remains a concern. Mitigation requires immediate action from network administrators and end-users. Organizations should block the domain and its resolving IP (35.157.26.135) at the firewall or DNS level to prevent access. Users who interacted with the domain should reset credentials for any accounts entered, particularly those tied to courier services, banking, or email. Monitor for unauthorized transactions or account modifications. Security teams should review logs for connections to the domain or IP, correlating with anomalous authentication attempts or data exfiltration. Given the domain's hosting on a legitimate platform, verify Netlify deployments for unauthorized or cloned pages. Educate users on identifying phishing tactics, such as mismatched URLs, urgent delivery notifications, or requests for sensitive information.