fexpresslogistic[.]com

Analysis of fexpresslogistic.com indicates a high-risk phishing domain targeting courier or logistics services. The domain was registered on October 10, 2024, through TuringSign Inc. d/b/a Cosmotown and currently resolves to IP address 163.61.188.7. It is flagged on two security blocklists and appears in 23 threat intelligence pulses on AlienVault OTX. Seven of 95 security vendors on VirusTotal detect the domain as malicious. The site presents itself as a logistics provider, with the page title 'Fast Express Logistics Company – We are efficient, liable and trusted to deliver on promise,' suggesting an attempt to mimic legitimate courier services. Infrastructure analysis reveals the use of WordPress, MySQL, PHP, Chart.js, LiteSpeed, Slider Revolution, jQuery Migrate, and jQuery, which are common in both legitimate and malicious sites. The SSL certificate is issued by Let's Encrypt, a frequently abused certificate authority in phishing operations. Despite the presence of a valid certificate, the domain remains active and is blocked by at least two security solutions. Defenders should treat this domain as malicious and prioritize blocking it at the network level. The exact phishing mechanics remain unconfirmed, as the site's content has not been fully analyzed. However, the combination of courier-themed branding, recent registration, and multiple security flags strongly indicates an active phishing operation. Further investigation into associated IP ranges and registration patterns is recommended to identify related threats.