swiftexpresscargo[.]net

This domain, swiftexpresscargo.net, is actively impersonating Swift Express Cargo, a logistics or shipping service, as part of a phishing campaign. Registered on March 11, 2026, the domain resolves to IP address 31.210.50.51, hosted under AS214036 (Ultahost, Inc.) in Turkey. The site returns an HTTP 200 status code, indicating it is fully operational, and is currently flagged by one security vendor on VirusTotal, with a Gridinsoft trust score of 0/100. The page title explicitly matches the impersonated brand, reinforcing the likelihood of a targeted phishing attempt. Analysis of the domain's infrastructure reveals the use of common web technologies, including Bootstrap, LiteSpeed, Slick, jQuery, and Popper, alongside HTTP/3 for transport. The SSL certificate is issued by Let's Encrypt (R12), which is consistent with both legitimate and malicious sites. Nameservers are hosted under ultahost.com, aligning with the domain registrar. While the use of these technologies does not inherently indicate malicious intent, their combination with a recently registered domain and a single security vendor flag suggests a deliberate attempt to evade detection while maintaining operational capability. Defenders should note that the domain appears on one security blocklist and is explicitly classified as generic phishing by at least one intelligence source. The site remains active as of July 12, 2026, with no indications of takedown or mitigation. Given the high-risk classification and the domain's persistence, it is recommended to block traffic to 31.210.50.51 and the domain itself at the network perimeter. Monitoring for related domains registered under the same ASN or nameserver infrastructure may help identify additional threats. The lack of widespread detection (1/95 vendors) does not diminish the risk, as phishing domains often operate undetected for extended periods before broader flagging occurs.