fd-express[.]ltd

This domain, fd-express.ltd, operates as a phishing site designed to mimic legitimate courier services. Analysis indicates it targets users by presenting fake parcel tracking interfaces, login portals, and payment pages to harvest sensitive credentials, financial information, or personal data. The site employs social engineering tactics, such as urgent delivery notifications or account verification requests, to deceive victims into entering confidential details. Infrastructure analysis reveals multiple technical indicators confirming its malicious nature. The domain was registered on November 27, 2025, through NameCheap, Inc., an uncommon registrar for legitimate courier services. It resolves to the IP address 88.223.85.135 and is currently flagged by 6 out of 95 security vendors on VirusTotal. Additionally, it appears on one security blocklist and is blocked by enterprise phishing detection systems. The site uses technologies like Bootstrap, jQuery, and LiteSpeed, which are consistent with phishing kits designed for rapid deployment and scalability. If you visited fd-express.ltd or entered any information on the site, immediate action is required. First, disconnect the affected device from the network to prevent potential data exfiltration. Reset passwords for any accounts accessed during the visit, prioritizing email, banking, and financial services. Enable multi-factor authentication where available. Scan the device using updated antivirus software to detect and remove any malware or keyloggers. Monitor financial statements for unauthorized transactions and report suspicious activity to relevant institutions. If payment details were submitted, contact your bank or card issuer to initiate fraud protocols. Finally, report the domain to local cybersecurity authorities or platforms like the Anti-Phishing Working Group to aid in takedown efforts.