orbitalglobalexpress[.]com

The domain orbitalglobalexpress.com has been identified as a credential theft phishing site. It impersonates a legitimate shipping company, Orbital Global Express, to deceive users into disclosing sensitive information such as login credentials and personal data. The domain was used to host a landing page with the title 'Welcome to Orbital Global Express - Premium Global Shipping Solutions,' designed to mimic a legitimate company's web presence.

Infrastructure analysis reveals that the domain has a VirusTotal score of 18/95, indicating a significant level of detection by security vendors. It was registered through TuringSign Inc. d/b/a Cosmotown and resolves to the IP address 192.142.54.88, which is located in the Netherlands and is part of AS214036 Ultahost, Inc. The domain was created on March 11, 2026, and is currently listed as a known threat on the PhishDestroy blocklist. Despite these detections, the domain has only appeared on one security blocklist, which may suggest a relatively new or sophisticated operation.

As of the latest assessment, the domain is offline. However, the infrastructure remains in place, and the potential for the site to be reactivated poses a continued risk. Users are advised to avoid interacting with any links or email communications related to this domain. Organizations should update their security policies and blocklists to include orbitalglobalexpress.com to mitigate the risk of credential theft and protect sensitive information.