app[.]corecargologistics[.]com

Analysis of app.corecargologistics.com indicates an active high‑risk phishing campaign targeting users of a logistics provider. The site returned HTTP 200 and displays the title “Home - sprintco Logistics,” a clear mismatch with the domain name, suggesting intentional brand spoofing. Six of ninety‑five VirusTotal scanners flagged the domain, and it appears on at least one reputable security blocklist, reinforcing the malicious classification.

The domain was registered on 21 February 2026 through Sav.com, LLC and resolves to IP 198.12.80.250, which belongs to AS36352 hosted by a commercial web‑hosting provider. DNS is served by ns1.korrectserver.com and ns2.korrectserver.com. The site presents a Let’s Encrypt R12 certificate, indicating encrypted HTTPS traffic, and the underlying page loads a collection of front‑end libraries including Bootstrap, jQuery, jQuery‑Migrate, Slick, prettyPhoto, SweetAlert2, and assets delivered via jsDelivr. The web server identifies as LiteSpeed, and a Gridinsoft trust score of 0 / 100 was reported.

Threat intelligence shows the domain is listed on the PhishDestroy blocklist and has a low Gridinsoft trust rating, both of which are typical of malicious phishing infrastructure. The presence of multiple popular JavaScript frameworks is consistent with a credential‑harvesting landing page that mimics legitimate logistics portals. However, the current content was not captured beyond the page title, leaving the exact credential‑capture mechanisms uncertain.

Defenders should treat app.corecargologistics.com as hostile and block all network traffic to its IP address and associated hostnames. Security appliances should enforce TLS inspection to detect any form data exfiltration, and email gateways should flag messages containing links to this domain. Continuous monitoring of the host’s HTTP responses and periodic re‑analysis of the page content are advised to capture any evolution of the phishing payload.