express-deliveries[.]org

PhishDestroy identifies express-deliveries.org as an active phishing site impersonating legitimate courier services to steal personal and financial data. This domain resolves to IP 37.49.229.75 and was registered through COSMOTOWN, INC. on January 21, 2026, making it a recent and suspicious addition to the threat landscape. VirusTotal currently shows 1 out of 95 detections, highlighting its evasive nature and the need for heightened vigilance. This domain poses a significant risk by tricking users into entering sensitive information under the guise of shipment tracking or delivery notifications. The use of a Let's Encrypt SSL certificate adds a false sense of legitimacy, while the domain's recent creation and low detection rate suggest it is part of a targeted campaign designed to evade initial scrutiny. Users who interact with this site risk credential theft, financial fraud, or malware infections. If you have visited express-deliveries.org, immediately disconnect from the internet and run a full antivirus scan on your device. Review financial accounts for unauthorized transactions and change passwords for critical services, especially those linked to shipping or payment platforms. Report suspicious activity to your courier provider and consider blocking the domain at your network level. Stay vigilant for similar domains, as threat actors frequently create new variations to bypass detection.