web[.]apl-management[.]com

This domain, web.apl-management.com, is actively impersonating APL (American President Lines) as part of a phishing campaign targeting users through a fraudulent login portal. Registered on March 12, 2026, the domain resolves to the IP address 43.169.14.148, hosted on autonomous system AS139341 in Singapore. Infrastructure analysis reveals the use of Nginx as the web server, alongside frontend frameworks Vue.js and data visualization library Highcharts, which may indicate an attempt to mimic legitimate corporate dashboards or tracking interfaces. The domain is served by nameservers ns1.teodns.com and ns2.teodns.com, a pattern observed in other phishing infrastructure linked to low-reputation registrars. It was registered through NiceNIC International Group Co., Limited, a provider frequently associated with abuse reports. A valid SSL certificate issued by Let’s Encrypt (serial YE2) is present, which may lend a false sense of legitimacy to unsuspecting users. Despite this, the domain is flagged by 13 out of 95 security vendors on VirusTotal and appears on three independent blocklists, including enterprise-grade threat feeds. No confirmed brand-specific phishing kit has been identified, though the page title 'APL' and the domain naming convention suggest an intent to deceive users into entering credentials or financial details under the guise of a shipping or logistics service. The HTTP 200 status confirms the site is operational as of July 12, 2026, and no takedown efforts have been observed. Defenders should treat this domain as high-risk and prioritize blocking both the domain and its resolving IP at the network perimeter. Monitoring for related subdomains or newly registered lookalike domains under the same nameserver infrastructure is recommended.