xpresslinkshipment.online

Fingerprinting tools identified a stack consisting of Bootstrap, LiteSpeed, GSAP, Swiper, jQuery, and JivoChat, a combination commonly seen in malicious phishing kits. The site was flagged by the PhishDestroy blocklist and appears on one additional security blocklist, confirming that threat‑intel feeds have recognized it as malicious. VirusTotal scans reported that three of ninety‑four security vendors flagged the domain, reinforcing the suspicion of malicious activity. No further public analysis of the page content is available, and the offline status limits current visibility into any credential‑stealing forms or payloads.

Defenders should continue to block the domain at perimeter devices, add the associated IP address 192.142.54.88 to deny lists, and monitor for any future re‑registration or re‑activation of the host. Continuous observation of the nameservers and MX records is advisable, as changes could indicate a shift in the threat actor’s infrastructure. Organizations using web filtering should ensure that the domain is included in both URL and DNS blocklists, and incident response teams should treat any traffic to this host as potentially malicious until further forensic evidence is obtained.