couriguydeliever[.]netlify[.]app

This domain is flagged as a high-risk generic phishing threat targeting users through a fraudulent courier service portal. Analysis indicates the site impersonates The Courier Guy, a legitimate logistics provider, to deceive victims into submitting sensitive information such as login credentials, payment details, or personal data. The infrastructure is designed to mimic authentic delivery tracking or account management pages, increasing the likelihood of successful social engineering. Infrastructure analysis reveals the domain couriguydeliever.netlify.app is hosted on Netlify’s platform and resolves to IP address 35.157.26.135, located in Germany (AWS EC2 eu-central-1 region). The SSL certificate is issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), a common tactic to create a false sense of security. The domain appears on one security blocklist and is flagged by 13 out of 95 security vendors on VirusTotal, with detection labels including phishing and fraudulent activity. The page title, The Courier Guy, directly matches the legitimate service, reinforcing the impersonation scheme. Mitigation requires immediate blocking of the domain and IP address across network security controls. Users should be educated to verify URLs before entering credentials, particularly for delivery or logistics services. Security teams should monitor for similar domains using Netlify or other hosting platforms with courier-related keywords. If credentials were entered, affected accounts must be secured through password resets and multi-factor authentication enforcement. Network logs should be reviewed for connections to 35.157.26.135 or related subdomains under netlify.app.