esaworldwidelogistics[.]com

This domain, esaworldwidelogistics.com, is flagged as an active phishing site targeting logistics or shipping entities. Registered on September 25, 2025, through Dynadot LLC, it resolves to 198.12.80.250 (AS36352, HostPapa, US) and remains operational as of July 12, 2026. The site returns an HTTP 200 status and uses a WordPress stack with MySQL, PHP, and plugins such as Slider Revolution and OWL Carousel, which are commonly exploited in phishing campaigns. The page title, 'ESA World Wide Logistics – ESA World Wide Logistics,' suggests an attempt to impersonate a logistics provider, though no confirmed brand association exists in the available data. Infrastructure analysis reveals the domain is hosted on nameservers dns1.safedatahost.cloud through ns4.safedatahost.cloud, a pattern observed in other phishing operations. It appears on one security blocklist (PhishDestroy) and is assigned a trust score of 0/100 by Gridinsoft and 1/100 by Scamadviser, indicating high suspicion. Twelve of 95 security vendors on VirusTotal flag the domain as malicious. MX records point to the domain itself (priority 0), a configuration often used to facilitate credential harvesting via email. Defenders should treat this domain as high-risk. Block resolution at the DNS and network level, and monitor for connections to 198.12.80.250 or attempts to access the domain from internal systems. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the threat, as phishing sites frequently use valid certificates. No evidence of payload delivery or specific attack vectors is currently available, but the combination of WordPress infrastructure, recent registration, and confirmed blocklist presence warrants immediate containment.