airglobaltrack[.]delivery[.]xpressworldwidecourier[.]com

Analysis of the domain airglobaltrack.delivery.xpressworldwidecourier.com indicates a high-risk brand impersonation campaign targeting the logistics or courier sector. The domain was registered on July 28, 2025, through Dynadot LLC, and resolves to the IP address 198.23.193.170, hosted on AS36352 (HostPapa) in the United States. No SSL certificate is present, increasing the likelihood of unencrypted credential harvesting. The page title, 'airglobaltrack,' suggests an attempt to mimic a shipment tracking interface, though the exact brand impersonated is labeled as 'across' in available intelligence—this may refer to a specific logistics provider or a broader targeting strategy. Detection data reveals the domain is flagged by 11 of 95 security vendors on VirusTotal, with Google Safe Browsing categorizing it as social engineering.

It appears on a single security blocklist and is blocked by PhishDestroy. Trust scores from Gridinsoft and Scamadviser are both 0/100 and 1/100, respectively, further indicating malicious intent. The domain's nameservers, dns1.geebytesdns.com and dns2.geebytesdns.com, are consistent with infrastructure observed in prior phishing operations, though no direct ties to known phishing kits are confirmed in the available data. As of the report date, the domain is offline, though this status may change.

Defenders should treat this domain as compromised infrastructure and monitor for reactivation. Network-level blocking of the IP 198.23.193.170 and associated subdomains is recommended. Organizations in the logistics or courier sectors should alert employees to potential tracking-related phishing attempts, particularly those referencing 'airglobaltrack' or similar naming conventions. Further investigation into the registrar's abuse response and hosting provider's mitigation actions is warranted.