coralcourier[.]com

coralcourier.com is a generic phishing domain that was taken offline after being flagged by security vendors. The domain posed as a legitimate logistics service under the page title 'Coral Cargo and Courier Services' but was designed to deceive visitors into providing sensitive information. It does not impersonate any specific brand and no drainer kit was identified. The domain is currently inactive, but its malicious intent was confirmed during its active period.

Technical analysis shows that coralcourier.com was flagged by 1 of 95 VirusTotal vendors, including Gridinsoft, and appeared on 1 security blocklist (PhishDestroy). The domain was registered through Cosmotown, Inc. on December 14, 2024, and resolved to IP address 163.61.188.222, hosted in the US on AS153568 NEW DHAKA HARDWARE. No SSL certificate was issued, and the nameservers were dns1.lytehosting.com, dns2.lytehosting.com, dns3.lytehosting.com, and dns4.lytehosting.com. The HTTP status returned was 429, indicating rate limiting or blocking.

Since coralcourier.com was a generic phishing site without a specific brand or drainer, users who may have interacted with it should change any passwords entered on the site and enable two-factor authentication on all accounts. Monitor financial accounts for unauthorized activity and report the domain to phishing databases such as PhishDestroy or the Anti-Phishing Working Group. Although the domain is offline, remain vigilant for similar phishing attempts.