globexships[.]online

Analysis of the domain globexships.online, as of July 12, 2026, indicates that it is actively involved in brand impersonation, specifically targeting AliExpress. The domain was registered through COSMOTOWN, INC. and is currently using Cloudflare's nameservers, gannon.ns.cloudflare.com and ximena.ns.cloudflare.com. The domain was created on November 17, 2025, and is resolving to the IP address 104.21.57.12, which is located in the United States and is part of AS13335, Cloudflare, Inc. The domain is flagged by Gridinsoft with a trust score of 0/100, indicating a high level of suspicion. It also appears on one security blocklist and has been blocked by PhishDestroy, further confirming its malicious status. The HTTP status code for the domain is 302, suggesting a redirection to another location, which is a common tactic used in phishing attacks to lead users to fake login pages or other deceptive content. While the domain does not have an SSL certificate, this is not uncommon for phishing sites as they often do not secure their web traffic. Out of 95 security vendors on VirusTotal, 3 have flagged this domain, which, although a minority, is significant given the domain's other security indicators. Defenders should monitor this domain closely, implement necessary blocks, and educate users about the risks of clicking on links from untrusted sources, especially those purporting to offer package tracking services. The exact content of the page has not yet been analyzed, but the title 'Package tracking with tracking number' aligns with the scam type of delivery phishing, where attackers often use legitimate-sounding titles to deceive victims.