metroswiflogistics[.]com[.]unionchb[.]com

Analysis of metroswiflogistics.com.unionchb.com indicates this domain was actively flagged as a generic phishing site targeting logistics and transport services. The domain, created on February 21, 2026, resolved to IP address 213.165.249.109, hosted on AS22611 (InMotion Hosting, Inc.) in the Netherlands. It was taken offline following detection, with security vendor PhishDestroy blocking access. The page title, 'Metroswif Logistics - Transport & Logistics,' suggests an attempt to impersonate a legitimate logistics provider, though no specific brand impersonation has been confirmed beyond the page title content. Infrastructure analysis reveals a Gridinsoft trust score of 0/100 and an SSL certificate rated R10, both indicative of high-risk domains.

The domain appears on at least one security blocklist, and two out of 93 security vendors on VirusTotal flagged it as malicious. No evidence links to specific phishing kits, targeted brands beyond the page title, or additional threat actor infrastructure were present in available data. The domain's short operational window and rapid takedown suggest a low-effort campaign, though its use of a subdomain structure (metroswiflogistics.com.unionchb.com) may indicate an attempt to bypass reputation-based filters. Defenders should treat this domain as a confirmed phishing threat.

Network-level blocks should be implemented for the full domain and its resolving IP. Organizations in the logistics sector should monitor for similar domain registrations or subdomain abuse patterns. While the exact content of the phishing page remains unanalyzed, the combination of page title, hosting infrastructure, and detection by security vendors provides sufficient evidence to classify this as a malicious domain. Further investigation into the hosting provider's network may reveal additional related threats.