sfexpress[.]online

Analysis of the domain sfexpress.online indicates active phishing infrastructure targeting courier and logistics services. Registered on April 28, 2026, through NameSilo, LLC, the domain resolves to IP address 37.49.229.75 and remains operational as of July 12, 2026. The page title, 'SUPER FAST EXPRESS – Courier, Logistics, Cargo and Warehouse,' suggests an attempt to impersonate a legitimate shipping or delivery service, though no confirmed brand association has been established beyond this title. Technical indicators reveal the use of WordPress, MySQL, PHP, Bootstrap, LiteSpeed, Slider Revolution, Slick, and jQuery Migrate, a common stack for rapidly deployed phishing sites. The domain is flagged by 11 of 95 security vendors on VirusTotal and appears on two security blocklists, including PhishDestroy and BLP-Malware. Gridinsoft and Scamadviser both assign trust scores of 13/100 and 1/100, respectively, further corroborating its malicious classification. AlienVault OTX records the domain in 23 threat intelligence pulses, indicating its inclusion in broader threat-sharing communities. While the exact phishing mechanism remains unconfirmed due to lack of page-level analysis, the infrastructure aligns with known courier-themed credential harvesting or payment fraud schemes. Defenders should treat this domain as high-risk and prioritize blocking at DNS, proxy, or endpoint levels. No legitimate business association has been identified, and the registration age (under three months) is consistent with disposable phishing domains. Further monitoring is advised to track potential shifts in hosting or additional infrastructure.