xpresslinkshipment[.]online

The domain xpresslinkshipment.online was registered on March 11, 2026 through NameSilo, LLC and is presently taken offline. The only visible attribute on the site was the page title, which matches the domain name itself. DNS resolution returns a single A record pointing to 192.142.54.88, an address allocated to the Dutch autonomous system AS214036 operated by Ultahost, Inc. The domain uses the nameservers ns1.hostcreed.com through ns4.hostcreed.com, and its MX record is configured with priority 0 pointing to the same host name, indicating a minimal mail setup. HTTPS is provided by a Let’s Encrypt certificate (R13), and the web server advertises HTTP/3 support.

Fingerprinting tools identified a stack consisting of Bootstrap, LiteSpeed, GSAP, Swiper, jQuery, and JivoChat, a combination commonly seen in malicious phishing kits. The site was flagged by the PhishDestroy blocklist and appears on one additional security blocklist, confirming that threat‑intel feeds have recognized it as malicious. VirusTotal scans reported that three of ninety‑four security vendors flagged the domain, reinforcing the suspicion of malicious activity. No further public analysis of the page content is available, and the offline status limits current visibility into any credential‑stealing forms or payloads.

Defenders should continue to block the domain at perimeter devices, add the associated IP address 192.142.54.88 to deny lists, and monitor for any future re‑registration or re‑activation of the host. Continuous observation of the nameservers and MX records is advisable, as changes could indicate a shift in the threat actor’s infrastructure. Organizations using web filtering should ensure that the domain is included in both URL and DNS blocklists, and incident response teams should treat any traffic to this host as potentially malicious until further forensic evidence is obtained.