windglobalexpress[.]com

This domain was first observed on March 18, 2026 and is currently active. It resolves to the IPv4 address 185.198.59.26, which is hosted in Romania under AS60117 (Host Sailor Ltd). The authoritative nameservers are ns1.ro.hostsailor.com and ns2.ro.hostsailor.com, and the web server returns HTTP 200 for the page titled "Wind Global Express - Transports and Logistics Company, Express Delivery, Courier & Shipping Services | Worldwide Delivery". The site presents a valid Let's Encrypt R12 certificate, but the Gridinsoft trust score is 0/100, indicating a complete lack of trust.

Infrastructure analysis shows the domain is listed on a single security blocklist and has been actively blocked by PhishDestroy. VirusTotal reports a single detection out of 95 scanned security vendors, confirming that at least one vendor has identified malicious activity associated with the host. The low trust score combined with the blocklist presence reinforces the classification of a generic phishing campaign targeting users of logistics or courier services.

Uncertainty remains regarding the full extent of the phishing infrastructure. Only one detection on VirusTotal suggests limited visibility or recent deployment, and no additional hosting, command‑and‑control, or credential‑harvesting endpoints have been observed. The simplicity of the landing page and lack of associated malware samples mean that attribution to a larger phishing kit cannot be confirmed at this time.

Defenders should block traffic to 185.198.59.26 and add windglobalexpress.com to internal URL filtering and email security policies. Monitoring for DNS queries to the domain and its nameservers is recommended, as well as alerting on any outbound connections to the IP address. Incident response teams should treat any credential submissions to this site as compromised and initiate standard phishing remediation procedures, including user education and credential rotation.