courierguy8374[.]netlify[.]app

This domain, courierguy8374.netlify.app, was registered on June 24, 2026 through the Netlify hosting platform and is currently listed as taken offline. DNS resolution returns the IPv6 address 2a05:d014:58f:6200::259, which is assigned to Amazon.com, Inc. (AS16509) and geolocated to Germany. The site presents an HTTPS service protected by a DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate and advertises HSTS, confirming that transport‑level security is enforced. A page title of “The Courier Guy” is observed, but the HTTP status returned is 404, indicating that the landing page is not presently serving content.

Security telemetry shows the domain appears on one public blocklist and is actively blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports that 19 of 91 scanned security vendors flag the domain as malicious. The infrastructure footprint is limited to the Netlify service; no additional sub‑domains or ancillary hosts have been identified.

Although the content of the page has not been captured beyond the title, the combination of a newly created domain, low trust score, multiple vendor detections, and blocklist presence strongly suggests a phishing operation targeting users of the courier brand implied by the title. Defenders should immediately add courierguy8374.netlify.app to URL filtering and DNS block policies, monitor the associated IPv6 address for any resurgence of activity, and consider extending blocklists to cover the entire Netlify sub‑domain space if not already in place. Continuous re‑scanning is recommended because the site may be re‑activated, and any future changes to the HTTP response or content should be evaluated for credential‑harvesting behavior.