globalaxisfreightlogistics[.]com

Analysis of globalaxisfreightlogistics.com indicates a high-risk phishing domain targeting courier and logistics services. The domain was registered on February 15, 2026, and remains active as of July 12, 2026. It resolves to the IP address 37.49.229.75, hosted in the Netherlands under ESTOXY OU, and returns an HTTP 200 status code, suggesting an operational webpage. The page title, 'Globalaxis Freight & Logistics | The most advanced, quick and reliable courier service designed according to the needs of customers,' explicitly presents itself as a logistics or courier service, which aligns with common phishing themes aimed at businesses or individuals expecting shipping-related communications. Security vendors have flagged this domain, with 15 out of 91 detecting it as malicious on VirusTotal. The domain appears on at least one security blocklist and is currently blocked by PhishDestroy. Infrastructure analysis reveals the use of nameservers ns1.controlpanel.sbs and ns2.controlpanel.sbs, registered through TuringSign Inc. d/b/a Cosmotown. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites. Detected technologies include Bootstrap, LiteSpeed, jQuery UI, jQuery, FancyBox, Popper, and HTTP/3, which are standard for modern web applications but offer no inherent indication of legitimacy. The domain's MX records point to itself (globalaxisfreightlogistics.com with priority 0), a configuration often seen in phishing setups to intercept or spoof email communications. While the exact content and functionality of the site have not been fully analysed, the combination of its courier-themed branding, recent registration, detection by multiple security vendors, and self-referential email infrastructure strongly suggests malicious intent. Defenders should treat this domain as active phishing infrastructure and block or monitor traffic to 37.49.229.75 and associated hostnames.