firstapexcourier[.]com

firstapexcourier.com was registered on February 3, 2025 through Ultahost, Inc. The domain is currently resolved to the IPv4 address 198.251.83.106, which maps to a server located in the United States and listed as FranTech Solutions. The authoritative name servers are ns25.asurahosting.com, ns26.asurahosting.com, ns25.my‑control‑panel.com, and ns26.my‑co, indicating use of a shared hosting environment. The site presents a TLS certificate issued by Let’s Encrypt (R13) and returns HTTP 200 responses over HTTP/3, confirming that the service is live and reachable. VirusTotal analysis shows that three of ninety‑five security vendors have flagged the domain, and it appears on a single security blocklist. Gridinsoft assigns a trust score of zero out of one hundred, and the domain is listed as blocked by PhishDestroy. These independent detections reinforce the high‑risk classification. The landing page bears the title “Welcome to First Apex Courier – Premium Global Shipping Solutions” and employs Tailwind CSS, LiteSpeed, Alpine.js, Unpkg, Smartsupp, and jsDelivr libraries. An MX record with priority 0 points to firstapexcourier.com, suggesting that the operator intends to receive email from victims. The combination of a professional‑looking shipping brand, the page content, and the presence of a live mail exchanger aligns with a classic shipping‑service phishing campaign that attempts to harvest credentials or payment information from users expecting parcel notifications. Defenders should add 198.251.83.106 and the full domain to network and email blocklists, monitor DNS queries for the listed name servers, and enforce TLS inspection to detect the Let’s Encrypt certificate. Continuous observation of any new security vendor detections is advised, as the infrastructure may be altered by the threat actor. Users should be warned that communications appearing to originate from First Apex Courier are likely fraudulent.